njrat | 91433d209f2255901d95cf13f3dd39add159e55ef899549c0fc6aa3081db9821

Resubmissions

08-01-2025 19:05

250108-xrwaea1rak 10

Analysis

max time kernel
1050s
max time network
1050s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08-01-2025 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zone-H Fuc_ker.zip
Size

384KB
MD5

faa611e34f55f3d5a972773b7194ba8d
SHA1

1e9d0de0d241d704fe5991ba898bf7c19cb3979b
SHA256

91433d209f2255901d95cf13f3dd39add159e55ef899549c0fc6aa3081db9821
SHA512

3ef093de7808600757357863dc3194d891a93813ad57f54afd025762c46bcc210d3ef61790d499debe896c295219196bb5a685fa67cc544208a3290dbf4c7c61
SSDEEP

12288:1It/iWEWy/AfJWhsOAmoLqkEarKOrJS/n:1Q/CsGzkLC

Score

10^/10

njrat hacked defense_evasion discovery evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

11cpanel.hackcrack.io:60791

Mutex

Windows Explorer

Attributes

reg_key
Windows Explorer
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1744	powershell.exe
3384	powershell.exe
3620	powershell.exe
892	powershell.exe
1968	powershell.exe
5252	powershell.exe
5388	powershell.exe
5380	powershell.exe
5252	powershell.exe
5388	powershell.exe
5380	powershell.exe
1744	powershell.exe
3384	powershell.exe
3620	powershell.exe
892	powershell.exe
1968	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5692	netsh.exe

Executes dropped EXE 9 IoCs

pid	Process
4228	Zone-H Fucker.exe
1448	Setup.exe
4576	Setup.exe
2996	Zone-H Fucker .exe
952	svchost.exe
2760	svchost.exe
1368	explorer.exe
1212	version.exe
5336	explorer.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ."	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ."	explorer.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	Setup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Setup.exe

Hide Artifacts: Hidden Window 1 TTPs 8 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
648	cmd.exe
4372	cmd.exe
228	cmd.exe
4744	cmd.exe
4400	cmd.exe
4896	cmd.exe
2964	cmd.exe
4368	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	Setup.exe
File created	C:\Windows\assembly\Desktop.ini	Setup.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zone-H Fucker .exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2784	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
1160	msedge.exe
1160	msedge.exe
3432	msedge.exe
3432	msedge.exe
3140	identity_helper.exe
3140	identity_helper.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3920	7zFM.exe
5336	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3920	7zFM.exe
Token: 35	3920	7zFM.exe
Token: SeSecurityPrivilege	3920	7zFM.exe
Token: SeDebugPrivilege	2760	svchost.exe
Token: SeDebugPrivilege	952	svchost.exe
Token: SeDebugPrivilege	1368	explorer.exe
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	3384	powershell.exe
Token: SeDebugPrivilege	3620	powershell.exe
Token: SeDebugPrivilege	2784	taskkill.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeDebugPrivilege	5388	powershell.exe
Token: SeDebugPrivilege	5380	powershell.exe
Token: SeDebugPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe
Token: 33	5336	explorer.exe
Token: SeIncBasePriorityPrivilege	5336	explorer.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
3920	7zFM.exe
3920	7zFM.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2996	Zone-H Fucker .exe
2996	Zone-H Fucker .exe
1368	explorer.exe
1368	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 1448	4228	Zone-H Fucker.exe	82
PID 4228 wrote to memory of 1448	4228	Zone-H Fucker.exe	82
PID 4228 wrote to memory of 4576	4228	Zone-H Fucker.exe	83
PID 4228 wrote to memory of 4576	4228	Zone-H Fucker.exe	83
PID 4228 wrote to memory of 2996	4228	Zone-H Fucker.exe	84
PID 4228 wrote to memory of 2996	4228	Zone-H Fucker.exe	84
PID 4228 wrote to memory of 2996	4228	Zone-H Fucker.exe	84
PID 4576 wrote to memory of 952	4576	Setup.exe	85
PID 4576 wrote to memory of 952	4576	Setup.exe	85
PID 1448 wrote to memory of 2760	1448	Setup.exe	86
PID 1448 wrote to memory of 2760	1448	Setup.exe	86
PID 1160 wrote to memory of 3440	1160	msedge.exe	89
PID 1160 wrote to memory of 3440	1160	msedge.exe	89
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 4504	1160	msedge.exe	90
PID 1160 wrote to memory of 2536	1160	msedge.exe	91
PID 1160 wrote to memory of 2536	1160	msedge.exe	91
PID 1160 wrote to memory of 3680	1160	msedge.exe	92
PID 1160 wrote to memory of 3680	1160	msedge.exe	92
PID 1160 wrote to memory of 3680	1160	msedge.exe	92
PID 1160 wrote to memory of 3680	1160	msedge.exe	92
PID 1160 wrote to memory of 3680	1160	msedge.exe	92
PID 1160 wrote to memory of 3680	1160	msedge.exe	92
PID 1160 wrote to memory of 3680	1160	msedge.exe	92
PID 1160 wrote to memory of 3680	1160	msedge.exe	92
PID 1160 wrote to memory of 3680	1160	msedge.exe	92

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Zone-H Fuc_ker.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1996

C:\Users\Admin\Desktop\Zone-H Fucker\Zone-H Fucker.exe
"C:\Users\Admin\Desktop\Zone-H Fucker\Zone-H Fucker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1368
    - - \??\c:\windows\system32\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\nqnxslxh.inf
        5⤵
        
        PID:1592
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:5336
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" "explorer.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5692
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- C:\Users\Admin\Desktop\Zone-H Fucker\Zone-H Fucker .exe
  "C:\Users\Admin\Desktop\Zone-H Fucker\Zone-H Fucker .exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8387c3cb8,0x7ff8387c3cc8,0x7ff8387c3cd8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,12999407101485177153,15350064763351501432,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1648 /prefetch:2
  2⤵
  PID:5980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3668

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe
1⤵
- Executes dropped EXE
PID:1212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:2964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\msedge.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\msedge.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SystemSettingsBroker.exe
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SystemSettingsBroker.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:5252

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\Setup.exe.log

Filesize
408B

MD5
252d820f60b1a8716c6ecf2a06f4efe1

SHA1
9be2566cf6aaf73ff7679db9cc2a6277b27a5896

SHA256
3b1cc12b59dc1e8a72b957d9b9be782c0cbf2a6fed1305b339e55f4ee38efe91

SHA512
49bc304d7454c112011474fdd557a3693fa7821b831d45fcea0cd2562cf23cad7b3512195054f7d90c7a8149f4c380cc8ab68131e7d5bc37066fbd0e0d580c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\explorer.exe.log

Filesize
676B

MD5
6ce69501f5fc3d86b1afc0db36c79332

SHA1
598dd8d64c8870ea53b94344c5bc72b8a3b68bae

SHA256
4ab4048bb34a5c22aedbf69b5db0e940456ca0428b6a6eb315cd7abd3b02287f

SHA512
ce9563c8d707043de9ddd2e9fcc892ab04093823c0c2c53a2c2137a55d2fcce6df966a7a71e48568ec4a2391b2227f9f8282f240aa66c088dfbdd43d76e01b8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\svchost.exe.log

Filesize
588B

MD5
0c58dbc9a794b32825516df4daf69dbd

SHA1
bb9324b7c1c929fc82fbce3b535fae872e2d0b46

SHA256
06566cb514a94a80523723b05acb8175993b9626533a1f254f0ea7680af1b3d0

SHA512
76b2a83faa0daa9909bc1f0890ca8adbe81b63a19337fe3a9339b1b8ad179b1f7f5863444b9ae89ac149b447b5ca56feb243b76d7f337f4bf4d9e61bb18d9df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
ba6189b1723d4f95d53ac5649b628a4e

SHA1
94c481f92c113c96b54d400a088b4ec47abcca0b

SHA256
3b0b642c8f827d00ca3eacfb78a24432f8ff968aee4700d9aee0e2b5a7c01277

SHA512
4eef77425264c2b5c3b5edd4d9c583dcd4098ae798517449f9d80e60e86e27387a0f5800789c8fed735501746bbdea58651fe514cbe53a92c55203ab1e120648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1af4ed587104e7848b720aa1ce43c496

SHA1
35a8bd401047056f6b8e5fcb1edca142ca0ec15b

SHA256
ac4f6a589051b5b8f4c49c48a380a99236de274f0f47888a6e0e99437d26cea9

SHA512
33902524f87d8fa39ec01abc46756ff0fd63631be1cad5bdaa6671e8cbe85c7ac3cbb2742968d0e489e4a6bc455ea6d64d35140d57df8a889e6f115e92b56e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
19c7cee9a2193b2af17210a98115070e

SHA1
bf253404287ae776848e5ac44e3bc5851c6eea52

SHA256
1770d9108e353e09fa261b9d15e60b3d4077ff8ede4db4cf521dbf6c36d95417

SHA512
5a9052c3823ccd0804ba8463ca46b48e3cf07bbaf717dd61eab228f7dfef4dacd0446222fa28fe98aa75eb78f1e276b1c1369c3088dfaa6e6916dc862108745d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cbfb090a2a3a5cd295ed5a22c5398252

SHA1
6b49b95a200e87ed200874a13573108d67213977

SHA256
45d3c72fd97d6dbaee17b7e8c1c79cba45ee643822d002750f63aa8cc0c9b216

SHA512
7eb9f55aebbcf9728d9f8c12b18e008e1c2e2e7aae0ea8b461134789b7df509f0f48e3a44028e037b5a12133d0a27c856fd3647d6c6cfdc29dc096921e4adf76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7027d6b3d38219d0843ea64eb7de2ca

SHA1
a93d72f55130466ace65d4021e2706badd0d5b57

SHA256
7568a31e923e713bc977c5664fb02482943571a230d749c439fa71113c2c7b2a

SHA512
1e178b13369ecc235c523e1fbcde3337aa0d415613cbb295a0657be0faf0ea7535dc889641bcaa4eef4a5cbe2e27d67b8173d65a77afd5169c75492811917f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7bb0657edecc0876fbfb9e405737929d

SHA1
922e6e30d1889ad109e4d5cf85b06730281bb136

SHA256
dec2d4c28fe5a6084ebc839300d5b476c89bf0454f31c482ab11eb45362b7144

SHA512
fe44fd8ab6bcc7a57442f4c5ccefe37bc750bff173a33afebf0ab1904b76b8732c8e4a8b9d5e04987924fe1e50901eb6925127ed647839b0f9186d1ab5fa4e9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d005c50e55dd600c6e89d5537682a83

SHA1
c59d14a1eb983dbfd1dc8346b2808430331e1b0d

SHA256
8f3b5d6b6936cb10607ffffb67b5c0c1b7aa2492da178fd6a6018f30522c5440

SHA512
f3ff785cd76c92e6ae5cb1d93f465a9bf75964b9e11dd5557f10594ffe000c4678cf131ad57bdbda98cb6870f689bcafe55b1479bbffc9afb4bbfacb30b12cc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
8178dd85accfab9b386a7f376bc5b3be

SHA1
1ad6cd31b5baaa35f3247f8cd5860a49eb4b45e3

SHA256
1b7a1195ce59de248c99b96dd7f95460f1c7438219bb81d149928b654b0e1012

SHA512
6881fc484a4c2d67953bba2ad14c9aa70a2d7689232f7c44be8ffac54f6301ed4c149c3164e2eea5629c653fa6ae06a064e0b862e6af79d1208bcff5acad1d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
2ae5e3a0eb31c73f9009fdd68267cba5

SHA1
83f9eaa2a30618be81479db4690641c68adb1761

SHA256
3794513ffcb10cf2882a29ab80eb0c892594d9f916573565e3ea9f81a36bfa61

SHA512
efecce3b6bc2a26413ff8c3aebcd6b1c78869c60e51941e6c3c17b12bdf7cf4b03d8599a31db444ff92f881be8726d3a9a9f187759855cbda7fcd15fbec8bb1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
d7bbfd92faf546d1cf9c41ed79f2ff88

SHA1
1818733f6584af74c8bf72386d4b8abeb671bff2

SHA256
456e6881c345f6a579cc68a8c20e8cc10a49d173a4053661b586243ef67375f1

SHA512
6bd492f6c49a8a10731fe87740798e5df452736a8df3528ba72f4b2377716bde141cf58e250f9dd4663ed93a5f5903865898e1563c03ac74250ff5d2aabb26fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
d2e2c9e744d35a9f859597b6096c47a4

SHA1
6d17fff5d5e1cfa35e487948f19016d79cea51b1

SHA256
6a8fe477d750c75d4ee7eda37bed38bb8eab9f25a3a5ee1982a96377009201e6

SHA512
da5d45e7c635c8c1ee698a5c703feacffdbe022c56f3be724fefd5899330075870c5bc4b53c467d252eaf3b7a6cf7f0d5c8d6e6209ecc0841879ce968394a707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
aaf41956ba06c2c83d264988dda421b8

SHA1
8e3b39933f7b616e78e4200d4b5b01e533e24a62

SHA256
131fa2192cc086cb4912e681d9ad19956a36f1871300e8894984ddd924c8ba90

SHA512
bfa342634799ab70534352b131dc4051dafb0645a186b3f1c40be5dce1cc5cd64bfa95b87bbcea8c4047963533626b8bd384374ddfab5ba1e192ce0deef483b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
1a02656f3ab4a0124277ba38062dd5b4

SHA1
32732659417bf1f368f8044f79fa8aa2be9a935c

SHA256
37c48f22e2687b53928b9d0f3568eae2c100df976f8e98e955913f3632eed620

SHA512
378f43179988de75d940a3631ff14728c3a6e7977d96e45793ec13f89d2e2c34258f3d6c74c191c3e548ac088fba66d47558e500efea90d857d3be3cafa90b1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
871B

MD5
8358cee91f0fdec03d3decfe16a0aba1

SHA1
0b1be419123a5405fcd4947b401c68d21504dbd3

SHA256
c21c99d42c81baee787cb3130c937e0cecee356cabe5a6d5eaa49d11bbb908b3

SHA512
a87b95843b558360bc69a286af5a638d08c1d657e903ceb9bb9285521c4a188024a2fc4fa0ca697bc12a956d3ae4f6d491e081dc96621c9594a4f8c3442fb601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585148.TMP

Filesize
871B

MD5
1073a2667434bae12f68e092d8a94a96

SHA1
95e0e4b9108ba6eaa6a7c2b79b95fba73492e93d

SHA256
5f66d378e1999e469ed0d8d057afd09d75855276338c1efbb26eacf19d05e558

SHA512
cc6faa1db92835c1da9a38914fb43c33ba24a96c4b381efee867303e6ec5b6c0246016c745f569fab5ef9a7292dff44f5991a50124c2b0e99bf145ffaba4d6a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cef8b78df7cddab299cf8cdbeaed97b9

SHA1
6c6439581201c2a8d17ed1deecd0562d92de1097

SHA256
d07b6cd4a8cb4b3e15aca6eedea76cfccef3236098040811902aef105baab509

SHA512
c8bbe71df074845d2b3ccb640e7e59b5d5f068071415518fbf10dbf569dcabf197f6ba0380760aefd9cd87f0c2357895409d478118f6c9bb1337bb0de47798c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
54e7733039974b5f5594de406fe0d575

SHA1
fe5ac9ba2190d0eb65ee1355755c0e17a6d86b47

SHA256
078b727775cd0f68f26a19bb61a520e72d3fa8d05b39daaf4d40384100ad7d4f

SHA512
23120ab1ac82c7e4ceef020eacf4ed928e9afde51510e91cfad869a83938b1cc6b544ae8d4e80e82aba38695b95002d4eaf52795fb89c507140a12ec95f76e1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c535e6d9-5f2e-40b4-812b-481379bd82e6.tmp

Filesize
10KB

MD5
183acc86887f13253e728c8ca6ec143b

SHA1
bef3e3db15143805be216f3da19c01d4633554b9

SHA256
bb0751a216799deed5fef8c03ef4cd4e2b06350ef76e539fc37b55e991420222

SHA512
63586d9ca2b81cb5f489d8a8edd5b69fb987e95ddb7fa937f3a901f213cb1bdd93b4345ee929623ed64effc6fe4522a1c115451f17b6aa8eb073db351bce5e4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e3840d9bcedfe7017e49ee5d05bd1c46

SHA1
272620fb2605bd196df471d62db4b2d280a363c6

SHA256
3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

SHA512
76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
408641808e457ab6e23d62e59b767753

SHA1
4205cfa0dfdfee6be08e8c0041d951dcec1d3946

SHA256
3921178878eb416764a6993c4ed81a1f371040dda95c295af535563f168b4258

SHA512
e7f3ffc96c7caad3d73c5cec1e60dc6c7d5ed2ced7d265fbd3a402b6f76fed310a087d2d5f0929ab90413615dad1d54fce52875750057cffe36ff010fc6323fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6903d57eed54e89b68ebb957928d1b99

SHA1
fade011fbf2e4bc044d41e380cf70bd6a9f73212

SHA256
36cbb00b016c9f97645fb628ef72b524dfbdf6e08d626e5c837bbbb9075dcb52

SHA512
c192ea9810fd22de8378269235c1035aa1fe1975a53c876fe4a7acc726c020f94773c21e4e4771133f9fcedb0209f0a5324c594c1db5b28fe1b27644db4fdc9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e8eb51096d6f6781456fef7df731d97

SHA1
ec2aaf851a618fb43c3d040a13a71997c25bda43

SHA256
96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

SHA512
0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
451KB

MD5
8279b0e5326e13b048dc80d47ce7e86b

SHA1
336ff5fbe4cae573d9a5f7092eb53ca879a9b456

SHA256
d063a1f446540260d177d7e4f25510164cbb079d22ce7715a51ad357aa71cfa6

SHA512
71c4d09c9a654ce6b682e1e832b2187cf71a22cd413d8da0828236542933f9607fbdf06ba8350d5e32f349469a690cd7239284f7986fcaba1f587ba89c7409e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a5mdpvry.tqy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nqnxslxh.inf

Filesize
619B

MD5
6f1420f2133f3e08fd8cdea0e1f5fe27

SHA1
3aa41ec75adc0cf50e001ca91bbfa7f763adf70b

SHA256
aed1ac2424a255f231168bcb02f16b6ea89603e0045465c2149abcde33a06242

SHA512
d5629e9835f881cd271e88d9ec2d2c27b9d5d1b25329ade5cfb9824a6358c9e98e66f1b89ac9459b4c540c02af2728129dd8523bdf007cadf28b5fa2d199a2aa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
360KB

MD5
5ac54821002a4fadaf6442f8a92aedcf

SHA1
dac20d18a12127b638c2ae6c9a12edc0e8247738

SHA256
6203289af6a2158634e4d8d9c6a8dec702f0f7e96917a1b3ecc64742e0634663

SHA512
8d1a416501cf05613113bdee02d62cc6680be5333ea2f84c5d32b731943440f4822399cbab92c4af056904a888d7c5f9acdb604d71a87b01a83a245b7b9972fb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

Filesize
318KB

MD5
23ce98b7618b4feb3c10bee606d171bd

SHA1
3e2359692f447a175610312be6f98f726d9defb3

SHA256
520d313db85b0b768df9ab47e1f13b8b38a2b77db505a3bb268709e02ed1c881

SHA512
6db4ac9a0a0a87ed37e053924fc6f6378de97131cbd11e58dde81839b8e2f1869cfdbcb1cd518bab6b3d43ae6d3b7ca7674ee5880e3e80c91cec1920fb61c38b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.zip

Filesize
134KB

MD5
d2d9035c0aeb4ca5ba1a079dba3c1710

SHA1
16b8d3635f77a042c36d7e04e4e38c0d623ef678

SHA256
1562959c5e47d9877668025ee56beed0ad0306681f4f092c731a544fa4a4ad7d

SHA512
ef78658ac632f38122cd36ffd1d193d43830c74a5973c6417d7b722f26eef83aa13a1fd4d0918f130e23b1b2146c80a426cb2dfd23d1717229f8f39c0fed80c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe

Filesize
84KB

MD5
15ee95bc8e2e65416f2a30cf05ef9c2e

SHA1
107ca99d3414642450dec196febcd787ac8d7596

SHA256
c55b3aaf558c1cd8768f3d22b3fcc908a0e8c33e3f4e1f051d2b1b9315223d4d

SHA512
ed1cceb8894fb02cd585ec799e7c8564536976e50c04bf0c3e246a24a6eef719079455f1d6664fa09181979260db16903c60a0ef938472ca71ccaabe16ea1a98

Download Submit
C:\Users\Admin\Desktop\Zone-H Fucker\Zone-H Fucker .exe

Filesize
751KB

MD5
be6b5ed2ea8326c63285cd0ecac70f91

SHA1
2cf48f3c606d6f0d351237c34b93d75f8ec2178e

SHA256
ebd5256bc7a78a2b2741aee94ee0681e3e7f005ad6b45be43ac31eb41937fcef

SHA512
fe856af0cbd55d3eec4d97b7e00247e22494fe7096fb3c9096b1b0e5a1771db685bc5fc7efffed4018b4fe8aa5a9df7cbd8a6456f03f6f958fd5173bb095ae9a

Download Submit
C:\Users\Admin\Desktop\Zone-H Fucker\Zone-H Fucker.exe

Filesize
1.2MB

MD5
97a56ed9e4c3527795e177a853a0c0ab

SHA1
7ced5222cedcf49137cdea519a680f122885f469

SHA256
eed52f0f6e6ed1326cf7eca413ef1dc679260ba7e0a6c33b2d60a7566bc865fa

SHA512
ad601e574edbb96148ed65941f9e39f797e1a826b8c3e9e8171ad57081be2e27d3cf3ad6258659043f963f8746413f64f8355c482c737cffbaa72b8cb29b2f15

Download Submit
memory/1368-482-0x000000001B8F0000-0x000000001B8F8000-memory.dmp

Filesize
32KB

Download
memory/1368-485-0x000000001B910000-0x000000001B91C000-memory.dmp

Filesize
48KB

Download
memory/1448-32-0x0000000000A80000-0x0000000000AAA000-memory.dmp

Filesize
168KB

Download
memory/1744-492-0x00000288E52A0000-0x00000288E52C2000-memory.dmp

Filesize
136KB

Download
memory/2760-56-0x00000000033D0000-0x00000000033D8000-memory.dmp

Filesize
32KB

Download
memory/2996-57-0x00000000057F0000-0x00000000057FA000-memory.dmp

Filesize
40KB

Download
memory/2996-50-0x0000000005910000-0x00000000059A2000-memory.dmp

Filesize
584KB

Download
memory/2996-45-0x0000000000DC0000-0x0000000000E84000-memory.dmp

Filesize
784KB

Download
memory/2996-49-0x0000000005EC0000-0x0000000006466000-memory.dmp

Filesize
5.6MB

Download
memory/2996-47-0x0000000005870000-0x000000000590C000-memory.dmp

Filesize
624KB

Download
memory/2996-58-0x0000000005AA0000-0x0000000005AF6000-memory.dmp

Filesize
344KB

Download
memory/4228-38-0x00007FF83A110000-0x00007FF83AAB1000-memory.dmp

Filesize
9.6MB

Download
memory/4228-21-0x00007FF83A110000-0x00007FF83AAB1000-memory.dmp

Filesize
9.6MB

Download
memory/4228-8-0x000000001BDE0000-0x000000001BE7C000-memory.dmp

Filesize
624KB

Download
memory/4228-6-0x00007FF83A110000-0x00007FF83AAB1000-memory.dmp

Filesize
9.6MB

Download
memory/4228-7-0x000000001B870000-0x000000001BD3E000-memory.dmp

Filesize
4.8MB

Download
memory/4228-5-0x000000001B2F0000-0x000000001B396000-memory.dmp

Filesize
664KB

Download
memory/4228-4-0x00007FF83A3C5000-0x00007FF83A3C6000-memory.dmp

Filesize
4KB

Download