njrat | hxxps://gofile[.]io/d/bKgr4K

Analysis

max time kernel
144s
max time network
154s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
30/03/2025, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/bKgr4K

Score

10^/10

njrat hacked defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

pdf-cape.gl.at.ply.gg:6772

Mutex

00567af5ec2bc52d723fbecaae5c104b

Attributes

reg_key
00567af5ec2bc52d723fbecaae5c104b
splitter
|'|'|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1972	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
2932	Server.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
31	api.gofile.io
32	api.gofile.io
35	api.gofile.io
45	api.gofile.io

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_118314127\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_118314127\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_65633169\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_1783129906\manifest.fingerprint	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_1783129906\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_118314127\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_65633169\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_118314127\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_65633169\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_1783129906\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_1783129906\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_469207790\_locales\zh_HK\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133878166646307899"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-73851796-4078923053-1419757224-1000\{A0833BB9-71BA-48FA-9633-FDD5EE2816A6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-73851796-4078923053-1419757224-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3064	mspaint.exe
3064	mspaint.exe
404	msedge.exe
404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeRestorePrivilege	1728	7zG.exe
Token: 35	1728	7zG.exe
Token: SeSecurityPrivilege	1728	7zG.exe
Token: SeSecurityPrivilege	1728	7zG.exe
Token: SeDebugPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe
Token: 33	2932	Server.exe
Token: SeIncBasePriorityPrivilege	2932	Server.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
1728	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3064	mspaint.exe
3064	mspaint.exe
3064	mspaint.exe
3064	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 5076	3044	msedge.exe	82
PID 3044 wrote to memory of 5076	3044	msedge.exe	82
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 1256	3044	msedge.exe	84
PID 3044 wrote to memory of 1256	3044	msedge.exe	84
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 336	3044	msedge.exe	83
PID 3044 wrote to memory of 932	3044	msedge.exe	85
PID 3044 wrote to memory of 932	3044	msedge.exe	85
PID 3044 wrote to memory of 932	3044	msedge.exe	85
PID 3044 wrote to memory of 932	3044	msedge.exe	85
PID 3044 wrote to memory of 932	3044	msedge.exe	85
PID 3044 wrote to memory of 932	3044	msedge.exe	85
PID 3044 wrote to memory of 932	3044	msedge.exe	85
PID 3044 wrote to memory of 932	3044	msedge.exe	85
PID 3044 wrote to memory of 932	3044	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/bKgr4K
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x274,0x7ffbde1ef208,0x7ffbde1ef214,0x7ffbde1ef220
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2252,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1876,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2004,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3476,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3520,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4304,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4868,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4856,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5556,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5904,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6076,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6064,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=6368,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6700,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7028,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7032,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7040,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=604 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6380,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5220,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6632,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5408,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3708,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5420,i,6387208109424581563,12483012703371055993,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1120

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5684

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\New folder\" -spe -an -ai#7zMap6152:82:7zEvent30457
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1728

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\New folder\image.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4312

C:\Users\Admin\Downloads\New folder\Server.exe
"C:\Users\Admin\Downloads\New folder\Server.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2932
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\Downloads\New folder\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
aad9ef568b38aa2ab42b57a3cbd8d8eb

SHA1
efe601b188069ca6b54ba6bd63866687c5574780

SHA256
ef0ca3af55b0eb83ea83d3376038feecaef97236df7c556f821c93bd08e86a9a

SHA512
5a3e66a1f995ed2779c7260787a2688118406190312d31e7a77bbfef233d81bbc17dd1bbf77a08ba73e390e22dd973c173b5eb39851b359a9196f48bb6fea963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8a474bbc092b6f25682401d0b1fa4794

SHA1
a578c7f66adce8f5d3b0a46a0090a62aab5f4afd

SHA256
6512283815830c6d1a3a0b6669df0155dc39f501fdd217096cbb88a075f2d3c2

SHA512
4ef4a14cb03ff6c01d4f5bfea2f58a4583c621526d6bcbf81b445cd9c6b4778dbbb4344804945d666c219f6fce432457e7de956703de1b3f3798eb8bf979b6da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57cbac.TMP

Filesize
3KB

MD5
896e5dfabb790a3ae316c0584aa8ddfc

SHA1
a2d0abfc9a5ca2e1e35f4deee29506ae04a32496

SHA256
66f854143b32099d7b9ea9e53026de97e4b57080e6aa0ba8299edaa7a3244476

SHA512
3da835fc992070838e7c920a9bc85a5ade9daf20908b7b73c969b7e6922c8a136e1eb110263d04808f21b21e563c12bdb0a30267b76a3739f18604484f7cc4cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
77219f9a35f3fcbea90851ba7e257203

SHA1
8aeeb45e9159176340d44b8b708a43ed4d3961e8

SHA256
ade538e960c3d5d71c12a1d5434eaf29e4657c5a3fa797bc86cf68aff3721184

SHA512
8d76c7f5b2d5cc71d18791ce8cbb28f827240bc08a857cbeaada6f58bc6f6d45b129db7986a33fc1519ba782fc1657e1706b2ea7b0f01cb2927c129000904fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
668561b1b49ad0efe7e5477beceff1c9

SHA1
e1637e6d12aa3723880dd131ca34212eafecb3a8

SHA256
52627583ed71cb30c628d8a2a511c1a19ccc5f27688810d0f4a164a5d4ce7820

SHA512
67e8e0cde0b49ef09fcb10fa011858a773b45e21f2c59162a8fe031b769f2186eeac2eaac82313db85d05c91ad6b9f2dbc2749122f5132274736fa34f6132095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
cf4aa5c5da5ac79a2747fde394723f78

SHA1
5187aa3a2cca51e2ba964ee65a1a9f5c8e285684

SHA256
a8d4c0f000aa5f0de162a88d5d49b79e28f00f0c5082e53b81f3f0678c9705a8

SHA512
cf7f68b6244e4ce8e171588e95fa911e7385b5731f164d86add18692f56ecab36e951f34adfb6f98749ed8b4f258403100ec203a8e5ab38123a00bd5fde9cc0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
0316b82c5f0c638ea46270c872084187

SHA1
f02d12da49a9426a356755bbeeb81cea029d9548

SHA256
5a72c0af5c2c59ee76d341c1ef57ad12a3b906f6d9d0d171342965d426714d89

SHA512
fc6085c43ce226d401d910cdc7fbf64d953f2c8dde0b6052d0df6a60da2b1319c7b74e3a1bd5fa55d8cc9a609274caae823fa93b919c5adce1f560831fe720a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
76bab6618f10e694a1a569f52fcab881

SHA1
7c088b2b90fbbd02f7a2a6bcc3ddd9895a76685d

SHA256
f7ef6326dbc4b318abeaa7df1b5a20ab51f6155bb55f5daa74c403eac89dddc5

SHA512
64990ec1bb0e1028a0eb93a67f00193946e36de20d2caa315e5ac1a3a2d64a63bc21edb8a127d8768a554e65ca2c5380c8eccc5af4bb7aa029034d25292e6d41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
f3cb3331bb969f5d39fe84c1f1a6a750

SHA1
956cbb76f2aa4b6a150cdb062b5944b1e4af01c3

SHA256
fb5676c07e4eaa81a5bb502ddf7b344024e5b2e475f6742b4547aa07aa5629c4

SHA512
21950a68d6a5eba89ba76c6e0c03fcacae7e9b58a2e1e93121e694ba36fe8b4d0667a3d3e2497ab44e23a5592efb019a2dade5a546b830cfa17c0cc9b7d9ce0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
25e1a771bd35b913b9597b0f761ac687

SHA1
b993585e6f98524a659da48aa2be46b8ff279843

SHA256
cfc5ca3a21cebe79492f80eb6e67283c5c4d6b99d01293d107e58e667406f7e2

SHA512
ec9f709c804d9423598ab4598a1832d60c4cdeada77e6c6a59dff0842cc1b061c0cad49e852e1c25ecb5c4fe4bcdd0d472891e05424ee17aae6e255e657aa4fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
904B

MD5
572635469e99f69cf5748ad74b77591c

SHA1
6ae4c01aa6258fc5d4a071569c231a7eb1a68764

SHA256
dcf1708001bf21f57a5e04533bb7e980c77fa65fda43d5d94c4848c19af7e996

SHA512
f595e94c174b4d0f72d445a11be1829359e37dbb33cddbcd8c554329902a19c08ed3c9e5807d45bc7184a3fff35ed6695cb678ed12ead07c33c25685e2341383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
7a3eb22057ccc18511c194ea3b467d5f

SHA1
a54a874173db34b4e1351f54362ebf273f36540b

SHA256
d2669546e1fe1ad85690b66dc496193bd84770b2b2cec7af97a4012d82493a3f

SHA512
2e9a026133445f46592ed6de7187b71f3d768d6aa0f639fff678d3f78af40d88952fa1e7e136e726242ef0c63f1214ab36eade0b3b0bb071204683606cd9dea9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
0844d9bd28eddf3b69b49eada6ee5db9

SHA1
103d2596c095a52f8b4c98ca8084870a8b24771d

SHA256
bcb3a46ad04d6df4149e0494d30d9f069c5bdb90b35bfe92af2d53fc906544de

SHA512
4081a763ba0536b2ea6e79f71cb832e1dc2f1157ee36298ee3eacbad41b4171539e5023926291f23120d9b5123577e126de6bd77f4e8e937fe1f57cc827b2635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
a556015776f65bb596cc48a014a7af08

SHA1
56f2887a5f30a96f9c877b4acc5e0247d2bd033f

SHA256
e9ef2a7fa52f76b280851e1490f0a0c91878dc7b43c609b8f5582278a9720ca1

SHA512
1ee601f5491f1fff99e36ef8e29371ea5117637a754b2337024cb5e3a9f7a93916662a75a4a26ec43203a5df2911f7d98f386c59a84f900c3c6982b09084ac8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
a2f463a6f4a0f0ab08f96de5e35e7dd0

SHA1
008aff2399cf66592d2d9a12aa64ec73f08d9109

SHA256
99631b7da6fd575783101d613b0291969717a3287abc5aeabfbcb936fe514d42

SHA512
4f28a53e3fca62a70d928a25a82f79b661e763151c7924b114a5ab238017286dac03c8ca1133b7cd46fdf338687181947e0aa9a6e4f6c58fbe94e4b2cdfecac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
b5816dae26a4be6a302772dbba17cb7b

SHA1
5bfa3e448bc31278d57ee96ecb6e01854a88bc62

SHA256
39dfbd6e0875f81cb720eef6b3bf52f46e9396074aa1517b2d0b906e4fb825ba

SHA512
3023bce89583dd076500042cb0753833cbe2b3bdc0d10d118e779b5aa85c8f0eb1a3c240cc98cd3408c2b39d57bdc1108656a36ea5b47c8cd32ae5f926a0ff8b

Download Submit
C:\Users\Admin\Downloads\New folder.rar.crdownload

Filesize
362KB

MD5
182e247edc00754d666a0c6391ce2e28

SHA1
71d04ee5a3fe1a5112f0fe5195b58611ac8158b5

SHA256
6ad46c5db5128d52a9e316c1a4b151512a05320678bc3c5ff0e2543c82e340ad

SHA512
097223bfb51bd9177537abf2a028f8f2467a2bfccae0c55e96de3fa062f9d3febdb67bde39cb813de9d10b5a00301ddc223d23d6e712d589c042b2d2ff593e5d

Download Submit
C:\Users\Admin\Downloads\New folder\Server.exe

Filesize
37KB

MD5
cb5c646402db2171de122a1a8959594b

SHA1
0732e8456f041a7bae31a69ee83076b475b8a628

SHA256
7bbab02779e323d38d8a5c1b1572ed7d276babf5a48eeabb9f71dc078842f169

SHA512
517ac9f56cdbedb5e5818d7e2b40b94f7d60e18be501b38d00bf2086a11a22be2c07058c2fe2bea570420902500ab7221d182c0f1cd1b2a168b118097dda108c

Download Submit
C:\Users\Admin\Downloads\New folder\image.png

Filesize
347KB

MD5
9b2f9b8698f8a6b3d80ccd4449e4b25b

SHA1
22960e139dcaf1d0a3ce4d32ee85e2265c13b927

SHA256
b7d096f1fd9fe8e8beb6a8939e5c38b2c6edfeed7e9c84fb506585e89a4c67df

SHA512
50fb6fb750dd99df04939814c75ec86241020849ca646179aa6d0bc3ff06ca067850dc0e97c60e6d3355a0c1e2c61fdc86b65edfbb5d3714a7d1cad8da81fa98

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3044_65633169\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit