njrat | hxxps://gofile[.]io/d/msOXuf

Analysis

max time kernel
893s
max time network
733s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250619-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250619-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
18/09/2025, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/msOXuf
Sample250918-tx8adabm5x

Score

10^/10

hacked discovery execution njrat persistence ransomware trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

el2rhabybh-61907.portmap.host:61907

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4880	powershell.exe
4712	powershell.exe
1084	powershell.exe
6104	powershell.exe
3252	powershell.exe
6108	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1046626855-4157782226-1738848475-1000\Control Panel\International\Geo\Nation	H-Malware Builder V4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1046626855-4157782226-1738848475-1000\Control Panel\International\Geo\Nation	H-Malware Builder V4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1046626855-4157782226-1738848475-1000\Control Panel\International\Geo\Nation	H-Malware Builder V4.exe

Executes dropped EXE 5 IoCs

pid	Process
936	H-Malware Builder V4.exe
4504	lll.exe
5396	ILMerge.exe
1616	H-Malware Builder V4.exe
5108	H-Malware Builder V4.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
34	api.gofile.io
35	api.gofile.io
38	api.gofile.io

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\svchost.exe	H-Malware Builder V4.exe
File opened for modification	C:\Windows\System32\svchost.exe	H-Malware Builder V4.exe
File opened for modification	C:\Windows\System32\svchost.exe	H-Malware Builder V4.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_209306128\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-ec\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1383101975\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_983587724\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-mobile-hub\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1383101975\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-ec\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\wallet\wallet-checkout-eligible-sites-pre-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\manifest.webapp.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-ec\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_190316605\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1544727171\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1544727171\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_53964676\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_983587724\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_53964676\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-notification\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-notification-shared\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-shared-components\es\strings.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_983587724\hyph-bn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_983587724\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-notification\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-notification\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-mobile-hub\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-tokenized-card\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1383101975\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_983587724\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_983587724\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_53964676\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_604926042\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-tokenized-card\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\wallet\wallet-tokenization-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\Wallet-Checkout\wallet-drawer.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1628212295\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_787419670\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_983587724\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-hub\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1713402923\json\i18n-tokenized-card\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1072017591\_locales\kn\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lll.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134026864583334910"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1046626855-4157782226-1738848475-1000\{C2C63596-8FD9-41BB-B22C-A1261A1497C5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1046626855-4157782226-1738848475-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
6108	powershell.exe
6108	powershell.exe
6108	powershell.exe
4880	powershell.exe
4880	powershell.exe
4880	powershell.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
6104	powershell.exe
6104	powershell.exe
6104	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
2084	msedge.exe
2084	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4504	lll.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5104	7zG.exe
Token: 35	5104	7zG.exe
Token: SeSecurityPrivilege	5104	7zG.exe
Token: SeSecurityPrivilege	5104	7zG.exe
Token: SeDebugPrivilege	936	H-Malware Builder V4.exe
Token: SeDebugPrivilege	6108	powershell.exe
Token: SeIncreaseQuotaPrivilege	6108	powershell.exe
Token: SeSecurityPrivilege	6108	powershell.exe
Token: SeTakeOwnershipPrivilege	6108	powershell.exe
Token: SeLoadDriverPrivilege	6108	powershell.exe
Token: SeSystemProfilePrivilege	6108	powershell.exe
Token: SeSystemtimePrivilege	6108	powershell.exe
Token: SeProfSingleProcessPrivilege	6108	powershell.exe
Token: SeIncBasePriorityPrivilege	6108	powershell.exe
Token: SeCreatePagefilePrivilege	6108	powershell.exe
Token: SeBackupPrivilege	6108	powershell.exe
Token: SeRestorePrivilege	6108	powershell.exe
Token: SeShutdownPrivilege	6108	powershell.exe
Token: SeDebugPrivilege	6108	powershell.exe
Token: SeSystemEnvironmentPrivilege	6108	powershell.exe
Token: SeRemoteShutdownPrivilege	6108	powershell.exe
Token: SeUndockPrivilege	6108	powershell.exe
Token: SeManageVolumePrivilege	6108	powershell.exe
Token: 33	6108	powershell.exe
Token: 34	6108	powershell.exe
Token: 35	6108	powershell.exe
Token: 36	6108	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeIncreaseQuotaPrivilege	4880	powershell.exe
Token: SeSecurityPrivilege	4880	powershell.exe
Token: SeTakeOwnershipPrivilege	4880	powershell.exe
Token: SeLoadDriverPrivilege	4880	powershell.exe
Token: SeSystemProfilePrivilege	4880	powershell.exe
Token: SeSystemtimePrivilege	4880	powershell.exe
Token: SeProfSingleProcessPrivilege	4880	powershell.exe
Token: SeIncBasePriorityPrivilege	4880	powershell.exe
Token: SeCreatePagefilePrivilege	4880	powershell.exe
Token: SeBackupPrivilege	4880	powershell.exe
Token: SeRestorePrivilege	4880	powershell.exe
Token: SeShutdownPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeSystemEnvironmentPrivilege	4880	powershell.exe
Token: SeRemoteShutdownPrivilege	4880	powershell.exe
Token: SeUndockPrivilege	4880	powershell.exe
Token: SeManageVolumePrivilege	4880	powershell.exe
Token: 33	4880	powershell.exe
Token: 34	4880	powershell.exe
Token: 35	4880	powershell.exe
Token: 36	4880	powershell.exe
Token: SeDebugPrivilege	4504	lll.exe
Token: 33	4504	lll.exe
Token: SeIncBasePriorityPrivilege	4504	lll.exe
Token: SeDebugPrivilege	1616	H-Malware Builder V4.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeIncreaseQuotaPrivilege	4712	powershell.exe
Token: SeSecurityPrivilege	4712	powershell.exe
Token: SeTakeOwnershipPrivilege	4712	powershell.exe
Token: SeLoadDriverPrivilege	4712	powershell.exe
Token: SeSystemProfilePrivilege	4712	powershell.exe
Token: SeSystemtimePrivilege	4712	powershell.exe
Token: SeProfSingleProcessPrivilege	4712	powershell.exe
Token: SeIncBasePriorityPrivilege	4712	powershell.exe
Token: SeCreatePagefilePrivilege	4712	powershell.exe
Token: SeBackupPrivilege	4712	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5104	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5412 wrote to memory of 2940	5412	msedge.exe	83
PID 5412 wrote to memory of 2940	5412	msedge.exe	83
PID 5412 wrote to memory of 3940	5412	msedge.exe	84
PID 5412 wrote to memory of 3940	5412	msedge.exe	84
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 4064	5412	msedge.exe	85
PID 5412 wrote to memory of 1584	5412	msedge.exe	86
PID 5412 wrote to memory of 1584	5412	msedge.exe	86
PID 5412 wrote to memory of 1584	5412	msedge.exe	86
PID 5412 wrote to memory of 1584	5412	msedge.exe	86
PID 5412 wrote to memory of 1584	5412	msedge.exe	86
PID 5412 wrote to memory of 1584	5412	msedge.exe	86
PID 5412 wrote to memory of 1584	5412	msedge.exe	86
PID 5412 wrote to memory of 1584	5412	msedge.exe	86
PID 5412 wrote to memory of 1584	5412	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/msOXuf
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x244,0x290,0x7fffba0af208,0x7fffba0af214,0x7fffba0af220
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1772,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2248,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2572,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3416,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3408,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5084,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4808,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4820,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3660,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3512,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3512,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6156,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6324,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6116,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5108,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6264,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5204,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=608,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6204,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6728,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5504,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5840,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5452,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3740,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5924,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5824,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6432,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3592,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2944,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:8
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4236,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6276,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=784,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6360,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7004,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3356,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1044,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5024,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5680,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7020,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7040,i,17198812911254080248,14151166141245925416,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:2836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5860

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\H-Malware Builder\" -spe -an -ai#7zMap19817:92:7zEvent32095
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5104

C:\Users\Admin\Desktop\H-Malware Builder\H-Malware Builder V4.exe
"C:\Users\Admin\Desktop\H-Malware Builder\H-Malware Builder V4.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4880

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:4804

C:\Users\Admin\Desktop\H-Malware Builder\lll.exe
"C:\Users\Admin\Desktop\H-Malware Builder\lll.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4504

C:\Users\Admin\Desktop\H-Malware Builder\Tools\ILMerge.exe
"C:\Users\Admin\Desktop\H-Malware Builder\Tools\ILMerge.exe"
1⤵
- Executes dropped EXE
PID:5396

C:\Users\Admin\Desktop\H-Malware Builder\H-Malware Builder V4.exe
"C:\Users\Admin\Desktop\H-Malware Builder\H-Malware Builder V4.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1084

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:6004

C:\Users\Admin\Desktop\H-Malware Builder\H-Malware Builder V4.exe
"C:\Users\Admin\Desktop\H-Malware Builder\H-Malware Builder V4.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:5108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3252

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:1240

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:5708

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:5908

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:1084

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:4076

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:336

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:3984

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:3592

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:5572

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:3868

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:2528

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:5092

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:2476

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

H-Malware Builder V4.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\H-Malware Builder V4.exe.log
Size 1KB
SHA256 4443a8e14d18d1c03b865eabfca6787ac6c523c1edef61809341a680c26b7080
MD5 ebec742e1cbb74325a031bc4d3098d4a
SHA1 47dcd96d01fdba6128f12a98c2a0e5982fd33cfc
SHA512 53480bad0abf1cb1389f25e9f01c133e3bdabf68254d98a83b722cd3523b4b95c0e38292e51be90e0860481462c805138b29a1d77d899401fa836e346d5f9dcf
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
MD5 3eb3833f769dd890afc295b977eab4b4
SHA1 e857649b037939602c72ad003e5d3698695f436f
SHA512 c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba14232f9cb19f4bf76d1ae7b04df64817f102a5bafd6b482eb3a00888bfc322
MD5 36d6ddd51958f3cf4471399f17b732f9
SHA1 c764cc33136fedd44be4733f72ff3ac2a70face2
SHA512 43b23dd088f52f2570efc6bb3d73c4436eec15a344674e86d640bbf32825e77809a50a3aa2c29902481d4d51a3e420efc66716d1afafcb69c27e44fcc0b5a5db
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 ddbe7d7c09a5e2179d0ee7110618a65ebe931ae7295dc77b28799aef9e8832a3
MD5 822fb000d8fcab5e74fe1bcdee869ae6
SHA1 02d7407d9683b4e8dbd611a2f11f165568047550
SHA512 8fc3a07a7b37f7af1554832d1a8db92604f0015f3f4233c5efd9c4b3a796ec96eb7dff9d229ab642bb94d87391e858a452c1c1239a7eec4bcbd5eac242cfbb70
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2d29bfc10856b3596f9dc13baa3faf926b4acadc8e4da8f10d2b962e8c276b86
MD5 75ba54977727d735e160179f1005f069
SHA1 6b16fe3419ee0802f643b7c4d3bcb048a6b666a3
SHA512 5f62e4e596a9f9166af4829e18cc80f341c5367be102125eeada6a4a5ea46e3d457ee45bf5c320579bfc2e47fb4ba5377e0c10cbcf31761bec01ecb2f1817965
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 384B
SHA256 e924f5f4861fab9879d21f658482ac61632d850c60532d022dd64ddeec204f1b
MD5 6a99b4997dca00acdb5e644abb180281
SHA1 a5e160ced53c32014ac8fd91f47e7453d078362d
SHA512 d775949db46ad90d504c06290eea97dd92bf0bbda773baff521212306840d82ed272a79d377b3e3e50a3490129348406dd5390c286a0823ffc26758c5526d1bb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 947b61621fc657a4f324c899f508c279a89ac35577a0cedaa09fa83cb2748ce2
MD5 e7198663ac8b901c37a4599026d59d08
SHA1 5860c7a2c5107afa38900ab67bd66c252aef4840
SHA512 bd646db8b899acbee8322b555904cb1d7b8174b792da8c64914dc1be4406eb59c7d28120e0cca8a2541c644240cefb2dd3ba2631059e4dce560839044274628a
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57c36f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57c36f.TMP
Size 2KB
SHA256 c0be3fe07ac075a87dc2dbd2b5f2fb7362cc114fe94befe75f36f7e6161450e7
MD5 049e6e9bef72186b5ed8863f425f8ed5
SHA1 9d7178ffb6f446a6d2f94eadc246ba2c02206834
SHA512 65790fcd5a60b930f11100f5d9901945c42bbd852825cb3cf4667492f5be5f5da4b4d55be9e8d20baa714d7c0246f8fc8824676b545b6ac78132f02400ec79db
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9a5756a81ea5fb04c374b8ab29b539936ebba4106e1674a802776fe212bb9518
MD5 f39ef5c67edbbfb245b42c8821b995a5
SHA1 f41825b908c230b3eeadbb3c47057e119eb89fc9
SHA512 548103121d55ab9f40146854451f66f97647f9f233b79fc9c484b7e8e8d4fee6c8ffed363f32ae23ff8272f835a4c71089c326915f314390b0fbac126f4fe998
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a0bb9fe25294bf4ab005414e7370d7a4ee87174a180575c7efae0598da74fbde
MD5 b640660a28cdb9890d7aca41cac78cb3
SHA1 3cc7fcd3274b6958324fd0a25617486d655f45f0
SHA512 4e439121fe08448b98a73d73d5328e28176c1bb4ef659036b859a5c182f970cbda2812b7aa6baf6f953acb69ffd00232054380fbc481c416844f06c360eee2aa
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6d632aa3aaa5e49d5a70aaba6164b138a7ee51ce37aa21cab70dc9f8cd23ca82
MD5 7b165f1263421dd225a000758fc1306a
SHA1 5b507d0ecdff6c1b436b2ec2f4976155a08a8ed0
SHA512 dfbde1f44a3d2522fe718d7b4903ab609e4f8f01c1d21b918e6f18d7be2c7ceff498350aa244c479a791a57db18f2dbab9278a84a4231fc481ed2a66895bac5b
SSDEEP 192:sV7RuyMqv/Ky0Ml8MCivsPfljwNdPHPW0fzoZ8phlMHY+WN02loYr6414c0SnrgM:sV7dLKivs3RwzvH74HSboU4c0SrgG/T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 bc22a1ce0c860365c4c0fc057f186896ae5c84279ec93cebe7c8cf3d3250e6a5
MD5 80cf7c4ab83e8ede9f12045d004a00ca
SHA1 40a76854be339ff702e216154065b7fb463921a5
SHA512 d569e2291dd50fa656abfb85116cee62608acf668da3158e362bf54263e24e1f418395124ecb5fe9dec83a61ddac9a872833f0f1cb1f436728a69e39d378aef7
SSDEEP 192:sV7RuyMqv/Ky0Ml8UQUCivsPfljwNdPHPW0fzoZ8phlMHY+WN02loYrc4L4c0Sn7:sV7dLqHivs3RwzvH74HSboy4c0SrgG/T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d5d99ec7a78d0937f007680a9a663372b9dd9f322131f28e0fb55be3bc98f853
MD5 d63459d9f4c0c045dcd5352f53010f72
SHA1 8015897a2d7872979b236ace843ff57688174f1d
SHA512 f011f8b5576e09a4012dcf04799fd244e743e5d8c0230cef87c901a8c4b5c7362a2d9ec9d6a86304da2c562ebf5cdc34cc871e839e760823a91d5490bc85c395
SSDEEP 192:sV7RuyMqv/Ky0Ml8M7ivsPflCNdPHPW0fzoZ8phlMHY+WN0dawYrdl14c0Snrgum:sV7dLjivs3UzvH74HSbwu4c0SrgGiT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 ebf14fb513d80cc3c4c269acf1f24259bc3da41b2aff46c51e39bc0abfc11ca3
MD5 a660b6d43be4c5f7fb1b5cf816dd47df
SHA1 3c42f015515dc0f3a155e31316bbb66e2f943f47
SHA512 5070f73cfdcf09d4484dd91ba2139f34aa20da0f73c0864d12e756244c1db7278b1463f2b23d841677ab201e8a197855215f458971aff4f01a94791a1d7b705c
SSDEEP 768:4NNBltl7pLmLlsEWFo84Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDvqDLlXRAsfroF:4NNBltz8lsEWFo84Qu1jasvqDL5WsMEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 251B
SHA256 b816ecec39303440be2bb027121ceb38ed7a9b6bee80195e584928497d06ae59
MD5 f899e04ef86f89e698d595c6bff7c39a
SHA1 b6d6e383fa617fa939f2bac4f8d4e083512794fe
SHA512 c2fc3bede65730a1a8317e22d18e1263e84b36573cd7dbac9bfd1389d5b750314936ed36e6ce35b4a1b477e376b566c3a2bf8381fd30b1c27198b77194725898
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 21KB
SHA256 6b145709b66317bad2986e14859176cb7a6c3001bb98d462103460a5f36e02a5
MD5 276052ba21451c551af85c620c70cb29
SHA1 87f87b8799be8fe823487534e63ab300d2b60af2
SHA512 8b19f16b5838e176ebc1f4386af1297ea0715dab5e40f70cf64ad51a90c42b3e657cd61f8fac34567db79f1cdd9d010e76440ea8588f39d0895270e9a9af5bd9
SSDEEP 192:FnwLXRNZ+9qDPjt5XKhOHhK8piAdeaQKm5erayoycAzO5WEKaDY8ao4vsJo0eMKF:A
MD5 SHA1 SHA512 SSDEEP

Submit Download

c8412bc5-415f-4235-a700-f5ed015aa42d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8412bc5-415f-4235-a700-f5ed015aa42d.tmp
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 beaa5a13ef2a232d53918294c56f96b69f4d2c98dc3dfb3736d2374e54f3e3cc
MD5 14641ed32e99e86b254abd7824a19f1a
SHA1 0decaf1325b18a095d917f9c39ade062f26605e1
SHA512 ab21e257a8e910ce3f43011fbbf12a0aee25921c821cc116197312ed292049bed4ff44c7b9ac99f0039acab274ceb01ccdac23c6e3c5d901987345ea0c0cdfa3
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 2065e3c9f885242d8e7e72ea69b1ab176e40ca40edd02f55a518a85ca44de288
MD5 1a3771095a3586f671e862d6e0f269cf
SHA1 a012884a0cbdc9833bb729c41346d7fd0d9012ec
SHA512 4ab768c5f5d6a1ffc05116517a34d8cdd2cc6f528c70439be28ff7000df5b47942cf0c9b617f6ae2e391a68040eab7f964765b94655b3c460df3b1abd4a10efa
SSDEEP 768:1F7BRE+D0tHVw7y3uCgTWQRkARtjBRHb8gQiqCE1DEgOZfjVz0b:gyG3rQvHjE1WfjVIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 f173f59d60ac1ddb0eb9cd4a7ef60545cc64f20e38ee85eb6798021f3d27b224
MD5 99dee15bfce7d355f3f49be25cd84364
SHA1 00fc72cd3647ba52172ae092b90944ea9cdfc889
SHA512 5afbe09211ffdec67c6202dab824e8b9e1d935c07ff5f45602b58957de07c96add61ac65b95e20ba47f1dca53e18277b09ad4cef307cd664c4686057f1fe22d3
SSDEEP 768:1F8BRE+D0tHVw7Ic3uCgoWQRkARtjBRHb8gQiqCE1DEgOZfjVz0b:1yUc3+QvHjE1WfjVIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 04c2c97b81f59298aa25e014dc06b82bdb26f2599c381efc86432274e4b07a57
MD5 105b854337daf92a9d758d737d2cf74e
SHA1 21579085b57ae476881345d292a81b3aa6898e38
SHA512 b7d35c62c35f4bdec64468c14841e48e77906e734749228b406ea3e220ddf1bc3d231421e1b80bceb0887fc2c38914fc73d8b90f27c4e71dbe59ff854bf96cda
SSDEEP 768:1FiE6esE8lDldUGec3uCg6WQRkARtjHRWEgOZfjV/E1JD49:ceB85dWc34Q1ffjV/E1i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 af914791fc6529be1e7eac5d31ca53ea8ed3cebf873c2e6bb745a3cf11d9cfd2
MD5 be9a8a6b0da42ff2f7f13a068ca388af
SHA1 e8538dc2a0d555fabd4f2901650253739b7cc1f8
SHA512 56e74f74ee780c0e2085738de307a3f1cb99a3135c8a921161d09909724f3c8e0b7bef0350b742b6d281b71c72c8f3a52e5abf77c9649468cd16c8da1b11453f
SSDEEP 768:+F7BRE+D0tHVw7F3uCgxWQRkAR7jwLRHb8gQiqCE1DEgOZfjVz0b:PyR3xQ+9HjE1WfjVIb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2c2c629a5bb33b8887522384cac86b004de50f270d259c7095f6e5f37fd0f26f
MD5 c974588d7ef142b55e898bcd3807e825
SHA1 f1a9018fabd54e852b550cba7d35c65721ccd04c
SHA512 1d0fb9616f9595c66d2f07fd887ffa2ae714644d11b93335ac9e53a1b2654f306493ebc1e7ba354b1419ec126891a7689cdb1a6ac8314211d0e8acdb4ee5c497
SSDEEP 768:MFiE6esE8lDldUGz3rCgDyQRkARt551KTH9f6iEgOZfjV/E1P49:1eB85d73eQ/1KpsfjV/E1M
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 add959c5c400ca601d4e67fa74d306bef20ab82cebadb71fa1ed91c54d3c4386
MD5 4c54026119a68e2a7f44372bbb28866e
SHA1 2b23f15d6f95d2f2c236e2a4f85476dbdfe77406
SHA512 ab99f564d4dc18079b1182207164551a0eb37af27cf7c2575231d8e42dbb08cf86486ee7f8ad00c4444e8092ee8c0feb3c728090b1b151b173925730ec77eaf7
SSDEEP 768:rFiE6esE8lDldUGz3rCgOJQRkARtjHRWEgOZfjV/E1P49:ieB85d73QQ1ffjV/E1M
MD5 SHA1 SHA512 SSDEEP

Submit Download

ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9
Size 161KB
SHA256 23b8196b76670ffac8063a91542118344bda24d7b2fa4a4c0dd146c4ee6b31b9
MD5 d6a332ceaa785f20d7cf0ef7b9fc4790
SHA1 65f275d0b2d7b017fc8727298498dd43833d0940
SHA512 d79eba8bc96fe187f1284e7c3adf9323bd0525f73daba3e6f97013297588119256aa1af82ddccbdff5483b466f22b1846ee2f44afeb84fecd7f2c6951b7aa659
SSDEEP 3072:D0siC87t5FyUgTnPw2Aee5WZ/2gtjccLyD1FLrhHopoqxPVv+J09vXOj:3MTyJrP7xe8/RyDf/mpoGX9vXOj
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 11065ca854ba7e7cb046495ffc683b1404f21c32b00b542a105f1a346c3be06f
MD5 b58fc504e503143f13fb8182a5126eed
SHA1 5d2526fdc3292e3d62b315b2f975cc9d06bdadcc
SHA512 019ab7c45e904dfeb0cbdbc15707de8909a4beee5fe8066a531a481f895e99e2314ec8aed7c2e7d76c38e3e7442bf9a7e87a3133ef6b8d00237d307954495ca8
MD5 SHA1 SHA512

Submit Download