njrat | 902576f7f90174513a45bc82796b82c9264a57c82c0c72b7c9bf11e7da6bba96

Analysis

max time kernel
862s
max time network
1248s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
01-04-2024 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plugin/cam.dll
Size

99KB
MD5

8ce3060686462fc72ece2701caa13e3b
SHA1

19fc9892200de4db332ddd0c14b4b6fd9a35ccd4
SHA256

881d5afb9aa4799c73e75dcd28587dba85dd844e4137287ea48c6b66525e2638
SHA512

ef38e00b054240a0d4747bfd79db860015ed027735c360de58af6889a69482109ccf74770608a2750542457ac38aa79367431ff6ca77fae44d7e3a7023f33a17
SSDEEP

3072:31IL2SeOPGmBUMqtZabredepzZxgUPWeJP3:w2Sm/MqueepzZxgQW

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

688 netsh.exe

pid	process
688	netsh.exe

Drops startup file 4 IoCs

Processes:

Client.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3297cda814fb30a725f976420f48da21.exe\:Zone.Identifier:$DATA	Client.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3297cda814fb30a725f976420f48da21.exe	Client.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3297cda814fb30a725f976420f48da21.exe	Client.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3297cda814fb30a725f976420f48da21.exe\:SmartScreen:$DATA	Client.exe

Executes dropped EXE 4 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exe

pid process

3192 Client.exe
568 Client.exe
1484 Client.exe
3400 Client.exe

pid	process
3192	Client.exe
568	Client.exe
1484	Client.exe
3400	Client.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Client.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Microsoft\Windows\CurrentVersion\Run\3297cda814fb30a725f976420f48da21 = "\"C:\\Users\\Admin\\Downloads\\Client.exe\" .."	Client.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3297cda814fb30a725f976420f48da21 = "\"C:\\Users\\Admin\\Downloads\\Client.exe\" .."	Client.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

Processes:

msedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Client.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 998700.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exeClient.exe

pid	process
4052	msedge.exe
4052	msedge.exe
4568	msedge.exe
4568	msedge.exe
2568	identity_helper.exe
2568	identity_helper.exe
688	msedge.exe
688	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3892	msedge.exe
3892	msedge.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe
3192	Client.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

Processes:

msedge.exe

pid	process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

Client.exeClient.exeClient.exetaskmgr.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: SeDebugPrivilege	568	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: SeDebugPrivilege	1484	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: SeDebugPrivilege	1448	taskmgr.exe
Token: SeSystemProfilePrivilege	1448	taskmgr.exe
Token: SeCreateGlobalPrivilege	1448	taskmgr.exe
Token: SeDebugPrivilege	3400	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe
Token: 33	3192	Client.exe
Token: SeIncBasePriorityPrivilege	3192	Client.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe
1448	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exemsedge.exe

description	pid	process	target process
PID 2032 wrote to memory of 5020	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 5020	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 5020	2032	rundll32.exe	rundll32.exe
PID 4568 wrote to memory of 4900	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4900	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4660	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4052	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 4052	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe
PID 4568 wrote to memory of 780	4568	msedge.exe	msedge.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\cam.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugin\cam.dll,#1
2⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffec52b3cb8,0x7ffec52b3cc8,0x7ffec52b3cd8
2⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
2⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
2⤵
PID:780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
2⤵
PID:1984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
2⤵
PID:3452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
2⤵
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
2⤵
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:1
2⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3560 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4724 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1020 /prefetch:1
2⤵
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
2⤵
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
2⤵
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
2⤵
PID:1288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
2⤵
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
2⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
2⤵
PID:2724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
2⤵
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
2⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
2⤵
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
2⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
2⤵
PID:496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
2⤵
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
2⤵
PID:1332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5844 /prefetch:8
2⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,3022970008991210514,16737961938748764683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3876 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3892

C:\Users\Admin\Downloads\Client.exe
"C:\Users\Admin\Downloads\Client.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\Downloads\Client.exe" "Client.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3764

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4376

C:\Users\Admin\Downloads\Client.exe
"C:\Users\Admin\Downloads\Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:568

C:\Users\Admin\Downloads\Client.exe
"C:\Users\Admin\Downloads\Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3140

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1448

C:\Users\Admin\Downloads\Client.exe
"C:\Users\Admin\Downloads\Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3400

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Client.exe.log
Filesize
319B

MD5
2a0834560ed3770fc33d7a42f8229722

SHA1
c8c85f989e7a216211cf9e4ce90b0cc95354aa53

SHA256
8aa2d836004258f1a1195dc4a96215b685aed0c46a261a2860625d424e9402b6

SHA512
c5b64d84e57eb8cc387b5feedf7719f1f7ae21f6197169f5f73bc86deddb538b9af3c9952c94c4f69ae956e1656d11ab7441c292d2d850a4d2aaa9ec678f8e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
341f6b71eb8fcb1e52a749a673b2819c

SHA1
6c81b6acb3ce5f64180cb58a6aae927b882f4109

SHA256
57934852f04cef38bb4acbe4407f707f137fada0c36bab71b2cdfd58cc030a29

SHA512
57ecaa087bc5626752f89501c635a2da8404dbda89260895910a9cc31203e15095eba2e1ce9eee1481f02a43d0df77b75cb9b0d77a3bc3b894fdd1cf0f6ce6f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
88e9aaca62aa2aed293699f139d7e7e1

SHA1
09d9ccfbdff9680366291d5d1bc311b0b56a05e9

SHA256
27dcdb1cddab5d56ac53cff93489038de93f61b5504f8595b1eb2d3124bbc12c

SHA512
d90dabe34504dde422f5f6dec87851af8f4849f521759a768dfa0a38f50827b099dfde256d8f8467460c289bdb168358b2678772b8b49418c23b882ba21d4793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
2234558e9c78375048039dbc85de14eb

SHA1
b64c604d80f7440ba0a4f20f7cae2c52e2971532

SHA256
635d61dfa7db88d0fe989db04cd0b9ddd32c981ba074e5c1aa1ac919dff60aa2

SHA512
6ee010dd550aa43b5668dd2f896f8b2b42e59fef425bbb651f909f2fb30e72f3386d59351b6f89f2c6de2a4e0b6eabac4eb159dde0ea89380e547f36dfba8382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
067d5f65b40bc8328fe83473add480de

SHA1
2073da236db9ab76901bae1644571d1aa9513513

SHA256
9a25ff413c1bf41edea5209d931862716f82d7f5f6cb167c89976c8e78f06545

SHA512
a4ab9f9363136e581e28b12259c6c4a906abe304c308eea2e5e9e091817a530e8d3cc325db072247ee5d4bcbe4d000b9de532197c2554ad2224edc85cc0b3ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
a52870191ff4e6a68838fdbca6168ec1

SHA1
b343c1e10b3603bcba6b9e56545d8263d604d464

SHA256
0f0e39925207d07c09c861f02bebd2de9620c4866e4bd3e14618e35a521e4b85

SHA512
970cc37831556afb0523831bd600efc323930a55176a929d58ca1947da12c639f50707e2b35ff2db30c3de0e3a7ac3bfaff84a6a4f4c6e718b7937bcb15b7215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
4ed5b13280d53df56d170a64111db0ad

SHA1
6cf696fb299dcdd5c44c940569efb517c0fb28f3

SHA256
933a8395bc317904f8f1fa78fc23afeedf9d1154690da2553880e40a25644243

SHA512
a4ea58063fe2957da8e2ffd7d6b2efdda2a82fb63b3a6516efc21ba1d7c4cc0e81d1401c4944325c5eea34e0751fca5cf1e4c011362bc31eb54d786deef9b85a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
7a6a59c5bcb22eb38b7dd4d404653af4

SHA1
c7120f23aa07098e893b1c8dccf2653f294e435a

SHA256
aaa50aa6b648cd0597f5952ac25916ec68c0cf2bd1e4794c805cbc2eaea3eb57

SHA512
1478bd655e33cc5d5fcd3d571790f48c4b9c58f361f7fd5afe2be89273d6361b7d06030c2649d24f70af7b2a94877535fdc97712c4edbf2c544876f3bf2acb27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f1b551f8c2478e7d0c34bbb4dde702e0

SHA1
ef4036e3a9aadeddf80aea2ccf996b09b097654d

SHA256
e20487a3945c37826804437fa7270f669f7e72ac80d2435eb0474158cb43c204

SHA512
04fd6d8b9d65f5326b772912339846d73f036003f336e74b0d3d32c069e2a26a7fe40273a7b028b2ffcc081f6cf7b864dcd8fe72241a9f548d3a6895500d4d67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
c2ad673457be47e8ac8a01ab02dab6ba

SHA1
2b70ef884fbb3d8a244a7a12939879f36874df03

SHA256
02d21fc3134172d0c3822f8350b5ed7437a40ab3611f57168534d2013ff8f201

SHA512
a7e7c966ec0c0f4868c81513cfe0e892aca1deb801aa066beac11f25dddf4e7472004710018ea85865139b4d88d19f410691274ea5a0a31d0870378b2c6bf450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f3103f449c528ba3e66cf8d3d16d964d

SHA1
515d891aa9776398f1f363b6bb708a377bcec47b

SHA256
0842d87cf09f8f7e141539e988013d55e749d62020edc7d678709b7bdc970b89

SHA512
08ddabecba5dbd22ade709e30b7373fa143c119bfb78151dceb878a50c2d040e0d4c07b1a97d4e4d027eebc7b948f39f8ec228cacc3781d810e48a214751eed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a5afbbb00fa23d1e9f42253ee2b7c3ea

SHA1
e403dfe637c83301b93163bbaf562a9205b3bc9a

SHA256
e0d782ec6e8ecd0eba6e3d2e1111759de45489530d7697bb69ed88cabd4eec09

SHA512
fcdd083d789a4aab6fbc79c4c298173dca13f65b772b60617f354844691ec05ccf0802be599bb7cf2e2389831c69791accf01372f0ff3119d252f5f7da27e0b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
65450d1270c836ca494723506a4f811e

SHA1
ee5b4239cb4451cafe74aed8c4457c536d47e246

SHA256
9d94d561e375fd52855a43a36f77407c32aa088a7e84f13543ab9f7d977fcf96

SHA512
6a71aaef88704e097886d87713d8a5571673ad03cce6de103ddbdd0b3e0a104b31171722ea527c01f9e4a8e9c24bf51c240a49e47dc53d54db9d39a67ca8d7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6faaea4b4ad4533d63862495144b663a

SHA1
8bf45bf634820942c6048cba82386b291d554df7

SHA256
bc5cd44b538826a8cd7230a4d406144a0ca07548cc0c27277dd8cfe6951b2ccc

SHA512
db17688bbf90e1bc77d31c6e4332fbbe5d8a2444839a9bace6f3ce3a2d04b5c2e37886d4aae7154a62eee36d0bc590e5a975cd2022a1f2848685f7b5ee2e7175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
b289a24533b898a713c6eba2d1b47edc

SHA1
1a3d5b289690f57fea5bf01fac39ffdd06dd2137

SHA256
700e5ad0220cbcb53090a8f37edad7eb845c57baaad6821fa87b52dfa5bc273b

SHA512
ed1caadccb200ae931d70378832181e0b8a8e2a8be4ddb44feaaac197a67fd828eabbb72b8d2f67df46c6e03bc1ee46b399349a5968b3bcf1eec23c1b4cba375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
11062c45fd7391273a701a573e23a519

SHA1
31ae5be8260c289af709177d075913cf5bb3b194

SHA256
0f5ef08267cf530144a5493541639235bc1bf756dd0f63f22782db5c16d85875

SHA512
e56c6a9e46bc37122b8c9f3b172f415264e97e98eeead092ad4d3d37519e5bc1d75eb7757545a42886df83d144934cc0bd004f32d521920444fe4ef26ae28343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
0fc9c5e82ebeb9f1858b5b55b3194d24

SHA1
39366817399ac3a3cc84c537456355d0c85127ac

SHA256
01d2addc2606f1af0a7acfebdd318bb3ed9a6c64050d72ceea0624af285ac5f8

SHA512
5e2c35adc78be1d16f8699da3f442f29d6f3a0a1549035bdbbd522b3d9872dc639f72ede56223e62f284d78140cdddb94426f6c59040b09ec1d61e60c41f2d08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
0fc4c166d458512f2a1a65d73f66b21c

SHA1
d73f6a32f7605f97f8f21b0954d604643916684d

SHA256
da785dcc773c115fe590f8f3c051991ddf350dca3c5cec64456dcf33c990ae24

SHA512
9c829eb3638009fc1df105f889dde7f24fd11e01b052bcf9f4167e130e011ffb3a16c9ed0ac86856cb0133e41969557d99c6774130303046b39b07bb57893564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
52610ea873622e9925bf499144a47f62

SHA1
c8d9b1cdd984e5cb6e086216230f3c2f89d61f34

SHA256
671e599b514907426bb1ff4a227a29caee8c9da565e30b5601975b50bbc87f50

SHA512
c077897be1ab8a7421ce1da5080013a9843b5d380911f838104bd4629aef54d8f8fe59fee54cc80812a49513c96c9c5dfeeb95ce93570183e94f24ead6d2c9cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe6263e5.TMP
Filesize
204B

MD5
cd4f2db47a2a4bdafa2e50817564ae38

SHA1
03e7fcfae0b88f12af17d620d870e6c8b0e03188

SHA256
b3071f684cd3df01b15fd5f07db62aa361169dfdd5ac4e0e2cf92bc388e76a39

SHA512
1bad653c32a7945c334ec13904986546c0fab8336808a507c037d2713f8b338abf99781e8e1845b2e1a37fc9b59b1722256ad24749f6b00fc7a6add23d3f01a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f637a82e-8516-46e6-99d2-d48fb9f1ee54.tmp
Filesize
1KB

MD5
74b387cf9ceb9f59b4667d8224fd664c

SHA1
a8401d781d1d9d5e3d70a1fcbbe552edfbc15884

SHA256
196134cd369ecb4c43a23e31201d99e6ebb9fa486d84cacc92e0eedca3c2106b

SHA512
7974166a2edc9a8e815b51f953dcd084f56084019aa9b22f15ff3dc8c9641d53b5496117fedf9c0551d0f0e2abe5aabbf2ca35ba0c92f20fc596a6a3ceb54c72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
84c9a27e70e7a71f903d0cab528536a8

SHA1
768a60206ccd05a1ebde42a24268b8ce35b01e69

SHA256
03403ff9862e0708d9ccee66b1eafd1818c489401aad19d09e6603cad487e524

SHA512
26495ac3baf6bdc3e1c4cf1d31f2c1fbc8db4d661afedab937703ed315d0491f6b93cff9de41ae942200ece991e278bb1d149402e3f5b1c3aecb955ba7acc326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
ea98771737e718c900737c602aa05e79

SHA1
26a47e114705fce9a314330f07835d6bcd3e7586

SHA256
efd303a2a32b462de49fa103e99a84cf72fa5f88de9ceca66fff7af7cd7cd2dd

SHA512
75d0b22ac870d9e8ff27cec7f3be30fa2435acb1483b63f05ce901f4b9f55fee60fadccada5c91908a08ce19ef720257eb02b3518ae00e78b6b09eb3fff0d714

Download Submit
C:\Users\Admin\Downloads\Client.exe:Zone.Identifier
Filesize
60B

MD5
98bfc821dd17ceab99bf109837d5e5de

SHA1
e7984a5394d76911040439bcb69ec90edbe90f27

SHA256
94db7eb75ccb8e8c70986849ab0cbb8396d5109a11b829823bcbbe6b7cf347e4

SHA512
975d030330acc53ab2d4222b9a3a06bf29e3b9259353755eab3bb4a6957f3b70c6f8b3e08cdaed3e1327aee42e0972b02a5ef74eff7908541e439a06aaf956d7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 998700.crdownload
Filesize
30KB

MD5
761900700a2dd93bf347e10fa9c14fb7

SHA1
db4904470793b785fd6b06c17312be4111da02e9

SHA256
cd21730a2de2f182773c6b9ef50d34ed9f3d55a94b7e20a987e91843f14a057b

SHA512
ce8a9bcee08e28090b84a860895079a3ef2b686fadc89d8cb859bcd36efc65734a03c7b8392f2a451d14ef14cc559e2d00463fe09a2c3f6ff5d0338996e5b4bb

Download Submit
\??\pipe\LOCAL\crashpad_4568_IORZKWZFLQBNXCPZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/568-600-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/568-612-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/568-598-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/568-599-0x0000000001360000-0x0000000001370000-memory.dmp

Filesize
64KB

Download
memory/1448-663-0x0000022BDB300000-0x0000022BDB301000-memory.dmp

Filesize
4KB

Download
memory/1448-665-0x0000022BDB300000-0x0000022BDB301000-memory.dmp

Filesize
4KB

Download
memory/1448-668-0x0000022BDB300000-0x0000022BDB301000-memory.dmp

Filesize
4KB

Download
memory/1448-667-0x0000022BDB300000-0x0000022BDB301000-memory.dmp

Filesize
4KB

Download
memory/1448-666-0x0000022BDB300000-0x0000022BDB301000-memory.dmp

Filesize
4KB

Download
memory/1448-664-0x0000022BDB300000-0x0000022BDB301000-memory.dmp

Filesize
4KB

Download
memory/1448-662-0x0000022BDB300000-0x0000022BDB301000-memory.dmp

Filesize
4KB

Download
memory/1448-658-0x0000022BDB300000-0x0000022BDB301000-memory.dmp

Filesize
4KB

Download
memory/1448-657-0x0000022BDB300000-0x0000022BDB301000-memory.dmp

Filesize
4KB

Download
memory/1448-656-0x0000022BDB300000-0x0000022BDB301000-memory.dmp

Filesize
4KB

Download
memory/1484-633-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/1484-636-0x0000000001410000-0x0000000001420000-memory.dmp

Filesize
64KB

Download
memory/1484-635-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/1484-634-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/1484-646-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/3192-597-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/3192-555-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/3192-556-0x0000000001610000-0x0000000001620000-memory.dmp

Filesize
64KB

Download
memory/3192-554-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/3192-610-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/3400-670-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/3400-671-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Filesize
64KB

Download
memory/3400-672-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download
memory/3400-673-0x0000000074FA0000-0x0000000075551000-memory.dmp

Filesize
5.7MB

Download