njrat | b78fb092e151db613cba51d7f2532547e48c6f4712809a485f272e2ab55776a5

Analysis

user interaction
yes
max time kernel
600s
max time network
591s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/10/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NjRat 0.7D.exe
Size 8.5MB
Sample261018-pastyscs4m
SHA256 b78fb092e151db613cba51d7f2532547e48c6f4712809a485f272e2ab55776a5
MD5 70ea9c044c9a766330d3fe77418244a5
SHA1 18602d0db52917b88cbdab84ba89181e6fd4686a
SHA512 5261865e7ca21e928b956a97518366c9dc218a2312961e0ba0b72b37ae7c797176382de3c3dc1d2949aca51c3db330562f1087a71efdc7c3c3b8f8928872f917
SSDEEP 98304:cn9aRMDoMu2EW5nnim//7uvwCt5tuo32v:cni6nnim//7uVtF
TLSH
T1CB965B12B295D914E1BD63F4C2E182F606B4BD0ED134C63B25A43F69B9F1BD1BC42B86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mybot credential_access defense_evasion discovery execution njrat persistence privilege_escalation spyware stealer trojan upx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

127.0.0.1:6522

Mutex

ba007e8d2e7178803743db9ae3b785aa

Attributes

reg_key
ba007e8d2e7178803743db9ae3b785aa
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2704	netsh.exe
4416	netsh.exe
3828	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	NjRat 0.7D.exe

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ba007e8d2e7178803743db9ae3b785aa.exe	Client.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ba007e8d2e7178803743db9ae3b785aa.exe	Client.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ba007e8d2e7178803743db9ae3b785aa.exe	tmp175.tmp.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ba007e8d2e7178803743db9ae3b785aa.exe	tmp175.tmp.exe

Executes dropped EXE 2 IoCs

pid	Process
5976	Client.exe
4336	tmp175.tmp.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4336 set thread context of 4396	4336	tmp175.tmp.exe	165
PID 4336 set thread context of 5052	4336	tmp175.tmp.exe	167
PID 4336 set thread context of 4680	4336	tmp175.tmp.exe	170

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4396-456-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/4396-458-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/4396-457-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/4396-463-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/5052-475-0x0000000000400000-0x0000000000472000-memory.dmp	upx
behavioral1/memory/4680-487-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Enumerates video capture drivers 2 TTPs 2 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	Client.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	tmp175.tmp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5876	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tmp175.tmp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tmp175.tmp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NjRat 0.7D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ilasm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp175.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5876	cmd.exe
5688	PING.EXE

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5368	msedge.exe
3984	msedge.exe
4508	msedge.exe
2316	msedge.exe
4744	msedge.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NjRat 0.7D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	NjRat 0.7D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000029678647ff41dd01fd2aaa040a42dd01fd2aaa040a42dd0114000000	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	NjRat 0.7D.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	NjRat 0.7D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NjRat 0.7D.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	NjRat 0.7D.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NjRat 0.7D.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NjRat 0.7D.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	NjRat 0.7D.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5688	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5512	NjRat 0.7D.exe
4336	tmp175.tmp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5976	Client.exe
Token: 33	5976	Client.exe
Token: SeIncBasePriorityPrivilege	5976	Client.exe
Token: 33	5976	Client.exe
Token: SeIncBasePriorityPrivilege	5976	Client.exe
Token: 33	5976	Client.exe
Token: SeIncBasePriorityPrivilege	5976	Client.exe
Token: 33	5976	Client.exe
Token: SeIncBasePriorityPrivilege	5976	Client.exe
Token: 33	5976	Client.exe
Token: SeIncBasePriorityPrivilege	5976	Client.exe
Token: 33	5976	Client.exe
Token: SeIncBasePriorityPrivilege	5976	Client.exe
Token: 33	5976	Client.exe
Token: SeIncBasePriorityPrivilege	5976	Client.exe
Token: SeDebugPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: SeDebugPrivilege	4396	vbc.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: SeDebugPrivilege	5052	vbc.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	1044	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1044	AUDIODG.EXE
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: SeDebugPrivilege	4680	vbc.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe
Token: SeIncBasePriorityPrivilege	4336	tmp175.tmp.exe
Token: 33	4336	tmp175.tmp.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5512	NjRat 0.7D.exe
5512	NjRat 0.7D.exe
5512	NjRat 0.7D.exe
5512	NjRat 0.7D.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe
4336	tmp175.tmp.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5512	NjRat 0.7D.exe
5512	NjRat 0.7D.exe
5512	NjRat 0.7D.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5512	NjRat 0.7D.exe
5512	NjRat 0.7D.exe
5512	NjRat 0.7D.exe
5512	NjRat 0.7D.exe
5512	NjRat 0.7D.exe
5512	NjRat 0.7D.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5512 wrote to memory of 3676	5512	NjRat 0.7D.exe	100
PID 3440 wrote to memory of 4572	3440	msedge.exe	116
PID 4572 wrote to memory of 436	4572	msedge.exe	117
PID 4572 wrote to memory of 5368	4572	msedge.exe	118
PID 4572 wrote to memory of 6080	4572	msedge.exe	119
PID 4572 wrote to memory of 6080	4572	msedge.exe	119
PID 4572 wrote to memory of 6080	4572	msedge.exe	119
PID 4572 wrote to memory of 3744	4572	msedge.exe	121
PID 4572 wrote to memory of 3744	4572	msedge.exe	121
PID 1100 wrote to memory of 4548	1100	msedge.exe	124
PID 1100 wrote to memory of 3984	1100	msedge.exe	125
PID 1100 wrote to memory of 3568	1100	msedge.exe	126
PID 1100 wrote to memory of 3568	1100	msedge.exe	126
PID 1100 wrote to memory of 3568	1100	msedge.exe	126
PID 1100 wrote to memory of 4512	1100	msedge.exe	127
PID 1100 wrote to memory of 4512	1100	msedge.exe	127
PID 5676 wrote to memory of 1228	5676	msedge.exe	131
PID 5676 wrote to memory of 4508	5676	msedge.exe	132
PID 5676 wrote to memory of 1172	5676	msedge.exe	133
PID 5676 wrote to memory of 1172	5676	msedge.exe	133
PID 5676 wrote to memory of 1172	5676	msedge.exe	133
PID 5676 wrote to memory of 4816	5676	msedge.exe	134
PID 5676 wrote to memory of 4816	5676	msedge.exe	134
PID 4248 wrote to memory of 6140	4248	msedge.exe	138
PID 4248 wrote to memory of 2316	4248	msedge.exe	139
PID 4248 wrote to memory of 4868	4248	msedge.exe	140
PID 4248 wrote to memory of 1144	4248	msedge.exe	141
PID 4248 wrote to memory of 4868	4248	msedge.exe	140
PID 4248 wrote to memory of 4868	4248	msedge.exe	140
PID 4248 wrote to memory of 1144	4248	msedge.exe	141
PID 3288 wrote to memory of 2148	3288	msedge.exe	145
PID 3288 wrote to memory of 4744	3288	msedge.exe	146
PID 3288 wrote to memory of 3916	3288	msedge.exe	147
PID 3288 wrote to memory of 3916	3288	msedge.exe	147
PID 3288 wrote to memory of 3916	3288	msedge.exe	147
PID 3288 wrote to memory of 3632	3288	msedge.exe	148
PID 3288 wrote to memory of 3632	3288	msedge.exe	148
PID 5976 wrote to memory of 3828	5976	Client.exe	152
PID 5976 wrote to memory of 4336	5976	Client.exe	156
PID 5976 wrote to memory of 2704	5976	Client.exe	157
PID 5976 wrote to memory of 5876	5976	Client.exe	158
PID 5876 wrote to memory of 5688	5876	cmd.exe	161
PID 4336 wrote to memory of 4416	4336	tmp175.tmp.exe	163
PID 4336 wrote to memory of 4396	4336	tmp175.tmp.exe	165
PID 4336 wrote to memory of 4396	4336	tmp175.tmp.exe	165
PID 4336 wrote to memory of 4396	4336	tmp175.tmp.exe	165
PID 4336 wrote to memory of 4396	4336	tmp175.tmp.exe	165
PID 4336 wrote to memory of 5052	4336	tmp175.tmp.exe	167
PID 4336 wrote to memory of 5052	4336	tmp175.tmp.exe	167
PID 4336 wrote to memory of 5052	4336	tmp175.tmp.exe	167
PID 4336 wrote to memory of 5052	4336	tmp175.tmp.exe	167
PID 4336 wrote to memory of 4680	4336	tmp175.tmp.exe	170
PID 4336 wrote to memory of 4680	4336	tmp175.tmp.exe	170
PID 4336 wrote to memory of 4680	4336	tmp175.tmp.exe	170
PID 4336 wrote to memory of 4680	4336	tmp175.tmp.exe	170

C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe
"C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5512
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\Admin\AppData\Local\Temp\stub.il" /output:"C:\Users\Admin\Desktop\Client.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3676

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x440 0x474
1⤵
PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault7498a946ha368h43a4h9f51h3427d0ff7b75
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault7498a946ha368h43a4h9f51h3427d0ff7b75 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffeae70c188,0x7ffeae70c194,0x7ffeae70c1a0
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,8415440740362136923,2269652268040979107,524288 --field-trial-handle=2248,i,1022177315550011914,18156975042978551743,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14212778592945989614,17807879170381499639,262144 --field-trial-handle=2248,i,1022177315550011914,18156975042978551743,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,6413407670500805924,2076188932206737242,524288 --field-trial-handle=2248,i,1022177315550011914,18156975042978551743,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
    3⤵
    PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault7cf9dce2h8495h43b4ha2f5hf6c7281b4d5f
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x2d8,0x7ffeae70c188,0x7ffeae70c194,0x7ffeae70c1a0
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,791315246237402831,13525968822542601095,524288 --field-trial-handle=2332,i,7634900625594160285,14399189169967051184,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,17331625201145032016,16541561209823944709,262144 --field-trial-handle=2332,i,7634900625594160285,14399189169967051184,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,13192899641933461181,8919214809626983531,524288 --field-trial-handle=2332,i,7634900625594160285,14399189169967051184,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultea1561fbh2c01h49acha0a7h4244fe15dcd9
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x2bc,0x7ffeae70c188,0x7ffeae70c194,0x7ffeae70c1a0
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,10316792974457978213,2028647677212557285,524288 --field-trial-handle=2260,i,6562553769556200272,2353065893092520549,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,1595557111389580229,14324176815955784649,262144 --field-trial-handle=2260,i,6562553769556200272,2353065893092520549,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,8742386748186600833,16410163209485213308,524288 --field-trial-handle=2260,i,6562553769556200272,2353065893092520549,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault1b8b981ah99d1h49b8hb244h39c0ff557370
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x228,0x280,0x7ffeae70c188,0x7ffeae70c194,0x7ffeae70c1a0
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,11916060287270886112,12683540398123938701,524288 --field-trial-handle=2968,i,4099988023962992549,13818644876192929030,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11234771207206227466,18446127467455942008,262144 --field-trial-handle=2968,i,4099988023962992549,13818644876192929030,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,10070356239486912224,14877689330040447112,524288 --field-trial-handle=2968,i,4099988023962992549,13818644876192929030,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:8
  2⤵
  PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault4da7f42fhed84h4f07h99deh542271e46a30
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x30c,0x7ffeae70c188,0x7ffeae70c194,0x7ffeae70c1a0
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,5411774565589568411,7145015182446676085,524288 --field-trial-handle=2292,i,1828258990057092439,4096002933375988801,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,10366023782064103655,9415991928654698439,262144 --field-trial-handle=2292,i,1828258990057092439,4096002933375988801,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,7873935945772044612,6811522602324357994,524288 --field-trial-handle=2292,i,1828258990057092439,4096002933375988801,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:8
  2⤵
  PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:816

C:\Users\Admin\Desktop\Client.exe
"C:\Users\Admin\Desktop\Client.exe"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\Desktop\Client.exe" "Client.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3828
- C:\Users\Admin\AppData\Local\Temp\tmp175.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp175.tmp.exe" ..
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\tmp175.tmp.exe" "tmp175.tmp.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4416
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\4571039"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\2784216"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\2476159"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall delete allowedprogram "C:\Users\Admin\Desktop\Client.exe"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\Desktop\Client.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5876
- - C:\Windows\SysWOW64\PING.EXE
    ping 0 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5688

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x440 0x474
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 947b8231afcd7b596cd7304499d1c57ec091d55b0d6c1ac43e5a3f6f178c8b57
MD5 be5b69c5ee908a8baecdb852b025e8f6
SHA1 cb35a40f38652ff6363d2ea6f9e44ce381dc6d7a
SHA512 256b3cd87e42945652fb294cbf2d621517ec4a5d0489de5fcc57a92079d217467cdf855c2f5e1545a57441139c6709f20e61857091e2d982dc7e7b0b2480eb54
TLSH
T186D02B4499C43B64E942243A22185281B04489560A07244041A303840C403B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b950a0f677cf0f2a4e74a3f03fe54132a959f457ad82eae9442cfade5d805db1
MD5 40d3ae341b5e8bc4722bd339d274c7e2
SHA1 10a5c0106a2d606c4e8a39949bcac3e28a710a4b
SHA512 3096799cd9b65d61e52a8845b59dc26d9c02c1adcf77d9d640b6abbbbaeb00bb4026b2609e9f4e0cb6cc0050ae6bd1fca9ae4f8368f2f75ab5cc0ca90a5a459a
TLSH
T1D6D02B4499C43A64ED42243A22285281B04489990E07244041A303840C803B200840D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

1bb62846-9a63-4791-847c-4c04de1338e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1bb62846-9a63-4791-847c-4c04de1338e3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

78313754-464e-4a13-be7c-1ed7f3ae8d06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\78313754-464e-4a13-be7c-1ed7f3ae8d06.tmp
Size 10KB
SHA256 99bddda2d2c212aa65e77fe13251e5ad788459aec083e6a8df85dc9c15aad34c
MD5 3759018bc3eb9e280ff6fb0cad1901f9
SHA1 e932516f403c187af9247adeb290fb5ce7ecdcae
SHA512 6c133eba2c1c2888094c4580e0d995df0d54114c75c41307fd3d939277487397eca5c15128a242620df7690086eaff6eddca59e5c2b709634a38499b55a771b5
SSDEEP 192:sxZpRA5s5QZZNIN7jIrpLHW6+WNGYbIQYUWphgigJ:sxZpi5s5OZNIMLHbGFQYULiE
TLSH
T10E32C855AD28A93F9CC7E61DFB557E53E3F9102264845E48AAFC8A2C14EB6CC220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e056907-9b61-4711-954c-945f3984a5b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e056907-9b61-4711-954c-945f3984a5b8.tmp
Size 32KB
SHA256 086e4dadd2541ae80a71cabcca716c57c09fe0d4e1569fd75787ac3c81d93d2c
MD5 06a7530eb9f7b91e3588aa07de36f1be
SHA1 a3e442b064d6ef4b219c9469fa559b5465c30dc4
SHA512 c0bc4ad8d0ecde30cd326d901f9891398e14603cf2996e26590ac45540befbf08396ce6f34f6c9c4d7b402c617147176f10058555fe28ddbad7faa825b2ada5a
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4wLWLlMC7fnroD:0RyktjYEbvnWvDBltu1ja5wLWLywf0LH
TLSH
T111E2EA3F780CCB7E4FC04E9DDD6A7E8B6DA802CB9598894047FA945C02C67EE511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2cd330456d994f033dd45a014a751d37fa3eef08b1dfc0f57b59b3b3353dfb14
MD5 9ca50974a5f52e3e3700d8b79a650e59
SHA1 8ec590b39db80c392e49df9ae0e97ffee24f427f
SHA512 eaf7150ceb82d43d42903af4eb9c5a190e0a7e011de675c6870f2e6097e7d95de14f27498d8c5028140dee7420925a21dab186476042483b3c2b7e7bdc0c9676
TLSH
T13C51D7B87A9088D0FB6C4871D9DC2287FEF485843E935E461597E8B8A87A77CC0B0850
MD5 SHA1 SHA512 TLSH

Submit Download

6d16ae7f-d3ff-4e19-bdea-27ce2dacc492.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\6d16ae7f-d3ff-4e19-bdea-27ce2dacc492.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 f4586e2ab9f1341ae768413394af8fc489f9091cc3aa02af5729555fd81febbb
MD5 a7571d05c2b44062217698f81fe58788
SHA1 ce222a5681ee9bf5a077676abc6c3ead65628b54
SHA512 e068931b52688f47039f75aca205bdd668096b4630e15fded4819899abd23b7f3f142909e762391f3f619a3896bc88ffcf37688206cd056108c54111482c5062
TLSH
T1ACE0D8E974CAC12E5A543497023C6B88C7C034D2D7977D0F5B00CCC8B60B151FB52947
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 346B
SHA256 7a9ea80e009edc07f0d1fb3ed68d49741832295c1420fdbd732f4005a46fd50e
MD5 818a9c7f93ed927ad063bb0b4365c073
SHA1 e28194f0a8afc4c5bb5e88eb0b378e75a6487652
SHA512 3fa0c43b48275028d3876b0d868f05e0e449830887b3707d2a18b29e68715959e479777047714f916f2191bbb1b3eacd22d3376382a095f5472bb0c1ab07ff9d
TLSH
T16FE0D8E454CAC11D57D434864228A708E3C43496E6A76E0F5B40C8C87607541BB96747
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 343B
SHA256 48132dfaa6171321bb4071a90819ad38aac3d0796ea4b2b492d34dc88e72af57
MD5 3b0682ac5b893562df384028bb177447
SHA1 9cbc3c37dff872fc8bb72a9087108b6dddbd52c8
SHA512 113a6661ddf6c571ac6119133dc32d28039ddade810d9a1eb7fa2210dfe4ece9c270d3cfbc8a4f8c9bd3c236e9f81cb19398095586a87a66e45ce2215478d640
TLSH
T173E0D896B4D6C12D56543686013C6B48C6D03893DAD66D0F1700C8C47A8A141F74399A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 860b34b42aabf5646103234488870ff381c24d5dac8704b2c138b6d5074588db
MD5 15b28afc968db501151eb79b665ec711
SHA1 111a430f8951607694216adee0e574cf66286663
SHA512 e4089cf210b51b93ee5025c6957f76bbaedbd9d6c57a10d0e26262fa445e3cccc4798295c9261099485d3cb930bf05a1794f70d4d1209d620754620603449679
TLSH
T1E9E020152CD8C13956986497037D5348DBE03853B79D3D0D5B49C8CA6105385E3C71D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 c2e825d9e1242b06a5a9978ebfacc2cbceda12475d4a0bc3fb0f941ad77b1a8e
MD5 acc41257108d9c34b43e5cf46277cce5
SHA1 73a6167881d2fbcd039be783a201677c558d722d
SHA512 aec343344949da82b9b5f719b0e9d73158becd73ff503038e3cedfd0a705681ce53f365df8d0ced52cb4e4146dd1d6f4a742074705d9125d754d1247d0a59fe1
TLSH
T1ACE026A424E8C2699158A9D7826DA388CBD034D3AA883D0F1B48DC84610A382E387792
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 cdf756b40bf991e3540ab7005912f4d82d2bb9a1a9f007ac5bd9ad8a24a17ad5
MD5 9bc46c887ce42b37cb35d837a5739579
SHA1 e34ad853ed0558c341d14cac0c7dc46e6709020b
SHA512 cc7178311980ecc13228211ce07d7625d9b12f321e2faf8e84e6464e9ed1a23dd3ba9ea52ae3c70f04ad1791357daa5d18b5264e5ddc2aff47f0fe8c06c432a9
TLSH
T1FAE0204804DCC119529CA4D703BEA70CABD0386EA2B47D1B1B48DC88710578177CB140
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 53e5b87c994dd7f50aa9eb13d0fd940d405cad5ba004cdcbe7eddf87e44e9368
MD5 f1cf01a1f08cc201f683a48dc28f6464
SHA1 f0fa51fd6edb1bc536ab98901844beaf109118b1
SHA512 b70daef509362f8cae2a93900c73d57e0201613db220b25e38f046834e2da30e49b07abea09045368bab9f71b9d4b6eca8435dde835489a3a60c9fd1d7c77dfc
TLSH
T1EBE0DF7264DDC1AA6348204F122C7B88CBE034A7E7892E0E1F04DE44B08A284EB826C3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 499eef36d57e4098693fe394f27973378fa7f2fa91eb474e680a67f829861f7e
MD5 56ef1fe3ecac44b41468fc992284aefc
SHA1 ea5936525d22c27f64bf5fafa21b0f5d0212481b
SHA512 730a8e106dd26cb59215e5d1e2c9cc6de88de0fc1e26cccf5ff882c7aa7461f658c8af246f5a064dc2b5bda1758c7194bd3426433afceafb6c20c2de52e1892d
TLSH
T158E0D865A4DDC1295388704B42697B48CBE1345ADA8E3E4E1B05DD49B409144B7C22D2
MD5 SHA1 SHA512 TLSH

Submit Download

1d783f1d-bdbf-459d-b9a3-b9a295a46d45.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1d783f1d-bdbf-459d-b9a3-b9a295a46d45.tmp
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

8ffb109a-8e4c-44a1-9cc6-e7fdaf1cc203.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8ffb109a-8e4c-44a1-9cc6-e7fdaf1cc203.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 473d2bbec3b5dc8561b3d01f1e86466e1c5e27e2b4215a1e0fb6fec9b8a5d3f5
MD5 bf297781fd57a0758988c924589d5f80
SHA1 680aabee184bcc3985edcdb922e70fbabee87b6e
SHA512 0eb4b082efe2e97a4369382338834b644897d5e8c4abdeb9d0bee6e34e0ba05556a503f586346a720fcfee4cd220eaba470c9a931953773a5829e4e40592e2b5
SSDEEP 192:sxZpRA5s5QZZNIN7jIrpLHW6+WNGYbIQYUm7phgigJ:sxZpi5s5OZNIMLHbGFQYUm4iE
TLSH
T13532D815AD28A93F9CC7D61DFB557E53E3F9112264845E48AAFC8A2C14EB6CC320741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6df5295baac9f1249e59716238926bb099c3b6216ab52b17fb8b742402051509
MD5 d022313e723c7ccf618261b8f1a47bed
SHA1 feeb596c086afc1691ed24d3567dcd95dd1b4972
SHA512 a5eb1a8ad00b897ea7a6900f29f3b72a30e7a7636503e8d48862a294d0fce45272b3fb2bf766ad4d43e9fc13fa9f8e42119038823e84e0ea96d2a5580927cda7
SSDEEP 192:sxZpRA5s5QZZNIN7jIrpLHW6+WNGYbIQYUm+phgigJ:sxZpi5s5OZNIMLHbGFQYUmjiE
TLSH
T10332C719AD28A93F9CC7D61DFA557E53D3F9112364845E48AAFC8A2C14EB6CC320741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 82d315191906c942faace5f7a0ebee10ed95a3414451a3ce99112be7d505a664
MD5 ee6e5c126871853dc68e170e56c38dc0
SHA1 86b31b92ed035c160a5f3d19e97479bc80bb5c4c
SHA512 328ca7b87a22f3b5151ca87ae2bec6a5348cf26d22c0bd9adee28c2e05ae75cd90d0562b16ba24647fba5289a7ac39d185f369ac2e60271b61a2f94e59cd9e7e
TLSH
T174E0262025E8C2BD615962870229D388CBE4B4E7DAC83D0F3F80DE84614B684F393593
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 e18b978a8d823f4993bcd7fd5f89fb5e6887995612d3675723e3365277d91ff7
MD5 4619994eea52dc3faddfa6fbfcc573e6
SHA1 53832dd02e2ff1f2000b8e27b23732bd2f2958b7
SHA512 2fe233ca8377c3b1974974a008ca5ee23f9be0d4fe0f15f4a3e5909240fbf3e7bf7cd6e28d00c75e547f4db0a436c90c2128bc3f519c914859f190201bb67398
TLSH
T1B3E020600AC4C13DB3AA204F07599B08F3D4B9BBD2F83D493F40D944754A645725B150
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 5de4200b02a4ae52e44529ec2cbf132814556034905d45f60a0aa61f25527b83
MD5 e5ed511201bc9167644e38d1f27a33d5
SHA1 6f4503507a7ac57ecd250629abf132ba45fcb78a
SHA512 c1d869a1d248039c03a066098b4a4ac3f2aa1c31948dc9f707ce578f36514d3143082e06253180217036f664aff65a054730ea33b668303f2903e45dedb8e489
TLSH
T162E0269035C8C13F6B692747023E9348CBE8B46BDAC83D0E7F89CA44614A684F2A31D2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 697da152263a3bf8509a3b66c531dc8f09fd40fabd110caf17c62611e14f2041
MD5 9f6af72a078f3fbd5d4914d3be22538a
SHA1 59d2f2497faf78bb0defb78d4925496607cae0d0
SHA512 70c2d8baa57c57596a5ddffcbd19972707e287c57674c14e059871dc195b69042de5d92d3024e64d13c46864e7ffd7ef667178cdc900e9a5045b8068f43eb0ca
TLSH
T1CEE0D83435CDC26AE289218B427DE34886F27492D6D92D1D6F0CD948A20B280B743542
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 754cf26b86e688124e9cb6b8e1caa364fba60818ef98ae02f28703d4a5121d08
MD5 ab739e32c33fb3c5cb7cbe94f13d4c3d
SHA1 7123ae7e37b514c5e4b2f6917e3b54672a9a44a3
SHA512 ea0fc3f475f0e18b9fde2093f771316c0e2d3519cd3ce1c2cb9758d787500725a2627a78ebb0bc679b6e26b3f5fdc4f9320a14748d442b4d33ed991f1dbdf79f
TLSH
T1B0E0D87459C9C22E63DA218F0329F708E6E2B556EAE9293A2F0CEA84720A6807757141
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 fb36bdc80bb0eff811a17abc58825fb09740f6eddd13935a68f95f273819b940
MD5 c27b3a864be89f565bbd52c33d996b46
SHA1 0bad688188debfa3ceff625a06e5370ab6de7342
SHA512 d3e69d391e039a9d48489c70c06047a3d96c02bf870a231f24c9e0f5e03935cc0accc182a2655acf46e70bab662ff06a0aff45b301739cdec5fa22d8b8e1a3fd
TLSH
T1B1E0D86075D9C23B6299218B023DE74886F37556DADA2E2E3F0ED544630E2C07353190
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 d451b34b3db5b9e616e2e6b99af3d454e7bc39d9827a0b6e51364e569d26e993
MD5 537003dbbf681b407b153896413fdd86
SHA1 933005b30b5b1e8d4d150388bdb1aa8db9b1e396
SHA512 85febdc977c776d9f8fb015d05e954e32cf8a074eef554e57c871ad38ed2519a3c53d26373c2cdb90fb45112d37ddfbe18a8bcb3c95c5bfe42982bb1b046af64
TLSH
T146E026B065D8C23B5258608B027DAB5C8BF07A5A9FC93E0E5B098484A509381F3B72D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 580ccac6c3d06da8a4aa050adfe907cca8e6a6358f2e85ed75a8e2ce799ee710
MD5 2c338c5b108288e0cadbebda5fbbd5ae
SHA1 01065c0ae0dd53a44f2c663fcc193330c8d7acbf
SHA512 a140cc3e2cdc492bdfddfbfc9f05ad5aa975db3de2b9fe70a8898407852234a0a6a81813fdc694087709fdd39ca50802919b9f33b6a68ecf4607d3162dc049fc
TLSH
T1EEE0267096C8C2395258708F0378BF4D9BF07CD693C93E8E6B088844A102688F3B7981
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 3316b36911eb22d43ee7a92aa2797f30e08e8e0ed36823b283edc4f14d5e70a6
MD5 6294e608efbe8f20b60f6742e0f1420b
SHA1 8cd13768c779b8c6e0626aa2349a328b8938b675
SHA512 956e53fe2722f763703a5c2285a55c1238de44daf3e9fe18e25b6ebbc64183b15f33eb177827cecdc4550d8458b884f475a57c7264e3f90105aa47d8c5c7fd4d
TLSH
T10FE020B045CCC23D519460CF0378AB4CA3F0F85E93D5392E5F0C99447201244776B181
MD5 SHA1 SHA512 TLSH

Submit Download

d847a7bf-ade9-4c2a-af1d-9525a097e5eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d847a7bf-ade9-4c2a-af1d-9525a097e5eb.tmp
Size 11KB
SHA256 fd3a5746b3d8236442d0f5236ebb0d19fd7dab2913b4aca2f327275e4bf7a998
MD5 cbc2bf4ce7b05d8bda3b89958362ce2b
SHA1 2af46385222f0a138f1cc183e7c88c381762cbc1
SHA512 cd04172bdcda95a4c34fdc93705504047541f47a11c4fab86b56fa69fcb7a1977446f09d402e2e2940083660f091839e012151f8e47758c5991789655a6aa096
SSDEEP 192:sxZBRA5s5QZZNIN7jIrpLHW6+WNGYbIQYUmUphgigJ:sxZBi5s5OZNIMLHbGFQYUmNiE
TLSH
T12232C719AD24AA3F9CC7D51DFA567A53D7F9112374849E08AAFC8E2C14EB6CC220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_cloud_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json
Size 13KB
SHA256 f9e4da319fe1f5a7d497c452421f4648a24ec7588f309ebea0f0cd61a6251eef
MD5 256c40bace492c4e28451ce149d2f9ac
SHA1 b48b0eaf986b9efc91d5c8dd394dccb6d82e2adc
SHA512 33b38d1ced015798722180fc8c8ce6daedb18cd5d0e4b3db27d6176c13cf3ccb1bd79f2e68ca390d6eb43ac508c29067e8f1a3ee9f0167cabe37ebbddf6b0ec0
SSDEEP 384:l7BJeojewj9mg1IZyvASoIL5QJwTcoEnE0YU/VwTcoEnE0GU58:l7BJeojewjcg1IZyvASos5FEnE0YREnA
TLSH
T12452007AD2211C7719B8636858BC4692F524137F8281C81F78BC656C8F7FA79A089FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 603aabb020a587a093b6b184d9c0d3da3a24bd1ecaeb5e87d98882696562640e
MD5 eef81497ae8f6470b431070e14d9e48f
SHA1 fb150b7d5a6a303f6412ca86813d9639cf74e39b
SHA512 25aa58d01e5808ecac01e90fb5fec5b194ac7c2022fb99d7cc69a46278d38c16122779bce168e403ce51d4b1403b33f9d83b1892eeeb96d4e94564c669d02949
SSDEEP 384:ntiFiZcI63sNSm8TUNTUlIm25mgJen4zfMBhFd1rv0cLMYPYVsa+VYdzgL/7Izh+:kFQ633mwgSBxBhFdOc4YAVhg++
TLSH
T151C23A72E894D9ABECEA8FD5E78A7603DEF0126381CC99C4DAD95D5D00871DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ff62f827f8505308bad5306cba3dfe0800aa67eb75827aeb56bbe57ace2c5b05
MD5 2e09c04abea623fbaf107a5515fee9cb
SHA1 dc8a7f589210dfefc3fce8639f6a92a558f0fa4e
SHA512 8aa1f1eeff5b54dd568370e183e7dd1ae31bbcd86ccb58010a72c26d23632d76da62fc16ccaeb86fab58e92e502acbaac3d2af9e614b06dc5f10858b645db561
SSDEEP 384:ntiFiZcI63sNo8TUNTUlIm25mgJpn4zfMBhFd1rv0cLMYPEMsa+VYdzgL/7Izhop:kFQ63ZwgSmxBhFdOc4YMMhg++
TLSH
T161C24A71E898C9ABECEB8BD5E78A3643DDF011A385CC9AC4D6D95D0D00971DD170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c9cb91055d2f3e7605ef2865b9931c6a356ee32c91f4a6b050eaff2a72736be8
MD5 20ddbca76b59d21a63857011a1bc8d85
SHA1 9bef3d5974e36e8093aecaba9c3ac760a76fdcd4
SHA512 4f2e1135e412c66c3ff88d875c14c6684f0bd2d41c03bae191a303368464b7d6fb63fcbd59c3d6e6fc2a1cd2044fb0eeb67d193b26765ffb49a5bd03e69e578a
SSDEEP 384:ntiFiZcI63sN+8TUNTUlIm25mgJ0n4zfMBhFd1rv0cLMYPkosa+VYdzgL/7Izhop:kFQ63zwgSfxBhFdOc4Ysohg++
TLSH
T1A2C24A72E894D9ABECEA8FD6E78A7603DEF0116381CC99C4DAD95D5D00871DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 6ab0b55b294299b002093cfd70e2eb579cfbaa574a1ccdd1f20c28e504d9ffd9
MD5 be6dcfd96912b306674425cdad04719a
SHA1 c44209f6be66670acfc827a1104cec26c703abb3
SHA512 4366719e091c196c0030fbfd9758882abd3b02691d2d5e550922980dd66215cc3ca51e297aefef23f6b00a9bcd7b620e69c4e1a0f0d1bf50fbd83d91a6765b22
SSDEEP 3:MsEllllkEthXllkl2zEflE:/M/xT02z
TLSH
T1854404047FC00405D550103040D3C3541770D4110711F74334D144337DDF5444C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 87B
SHA256 c7209c3eb51763e3139fa0a5e5a1d18b610932294b507ba5d043658e45953727
MD5 8e0265073c65dc7491c8b6eda0b62e0d
SHA1 b75642618bae1886d9c426b5183a13da6c21acd3
SHA512 45b190ca41357baa1dbdeff2b123d27428be4c2dd69cb88cb6070f5d6abe9a7728f47fa2844592b192c17961580225348aeb1ec270e161a7422c1a8b71a239d8
TLSH
T168B02447C473C00FF41440D1C45C03C114F4C047411DD0015070D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 4cb34594f4721fc1e8e6319e639df9f7766e5b2538c56500672999427de8349d
MD5 05114f830053d5e0ff48766e39538edc
SHA1 791c8304ea93663a2b73ee77c734e7889c80ddb6
SHA512 1a0fcda8c53d669360603bb913607522ce99134f98aba192bd774c9cab8b2f83b7f6a210b809b71769a50a20ccb8ca382b00a0a4b43a30165706b2eb8b9a8c24
TLSH
T153A0124384738406E4144091C45C1381287CC0574119C0012074931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

c72054e6-f45e-4f81-8387-d8516274c354.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c72054e6-f45e-4f81-8387-d8516274c354.tmp
Size 26KB
SHA256 dfba51a622147444f27caa51ae0c27ef9b8bf9ed254cd0534656df740bbd4d50
MD5 d417937ab81ff0cb128fbabeb8189e7c
SHA1 69fe4772bcb01cb32d681c3ade5329f4a1e32ba6
SHA512 6294232bc3c317c952f16789a0d538f139e8909dd011b9a3e7bcdc84198852a813378c83779734f1681d5cbb194720949a3c9c5386b0584924ab244a8003d3bf
SSDEEP 384:ntiFiZcI63sNo8TUNTUlIm25mggbn4zfMBhFd1rv0cLMYPEbsa+VYdzgL/7Izhop:kFQ63ZwgSXxBhFdOc4YMbhg++
TLSH
T1D4C25B72E894C9ABECEB8BD5E78A3643EDF011A385CC9AC4D6D95D0D00971DD170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7b9e964-2a2b-455b-a0f4-3987d85543cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7b9e964-2a2b-455b-a0f4-3987d85543cc.tmp
Size 25KB
SHA256 596bd5d34881d778b9a0704630cf3fabf3acdc6b0915e67515f7a6a8c2e69e8f
MD5 2e790857d775d3dd8f5bd2524b6ac7c1
SHA1 7ddd5685ec37409c1b57c6c292ca70120579c3b9
SHA512 1ecc2aa373f30da771be845f3beb1ababe441a4d742950d09d701c0b1039cd4a0d188ae8e747d34681a622a226e4425863ed9a2f0c6790f310bfb8221849dcfc
SSDEEP 384:nQiFiZcI63sNp8TUNTUlIm25mg5zn4zfMBhFd1rv0cLMYthsa+VYdzgL/7Izhop:rFQ63wwgSgxBhFdOc4Ythhg++
TLSH
T135C23972EC94D9ABECEB8FD5A78A7A03EEF0016381DC99C4DAD95D0D009719D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2784216

Path C:\Users\Admin\AppData\Local\Temp\2784216
Size 507B
SHA256 c2f229ba47f29fccb6d35a908e887bf97e9e87cdb1110e855d5caa39571e5d72
MD5 6d0e849b0647746facd7c73f03b4d366
SHA1 3138201a6608428b922bd86168b51cf80615bc91
SHA512 3839589f64141ba269f95e2726dd040ee09b6c9c09f5765dcdba847b02f68fa000b588a272f17e73ac42e81b3bb154535dc20da6dce0682b4b3a1ac2daada86a
TLSH
T120F0F29E110B90625B157A3024AF780CA96D28DACCD5D0E8FAFDCBF21D8B82685D416D
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Login Data
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stub.il

Path C:\Users\Admin\AppData\Local\Temp\stub.il
Size 338KB
SHA256 21251f5fa6fec8e9fbfd82e577c4b3e3299ce146d1fb67ede94fdb997fe8900d
MD5 2feecee585eeddc7270d93f3b9a8c867
SHA1 002a04abdb81adc43649937ba0c0c4d5784b9969
SHA512 d6c7527000ebe2f22f46887f4c50bdb86e743c20965acff10bb3705ecb8df24363a73d59d2deab464785ccf7801442965524722aa390ddf7d401d15dcaed5095
SSDEEP 6144:p4Y54wj3kCi/A9rOQCMUJIghk/UgfnktBSMsC9VF2:p4Y54wj3kCi/A9rOQCMUJIghk/UgfktG
TLSH
T1FE74BC288228959AD5B2A51DBE71CB46F77F12270F31AC967DEFC254BF31284817063B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.exe

Path C:\Users\Admin\Desktop\Client.exe
Size 30KB
SHA256 25aa3780c2563d1671b89cbb7e9f89e0174d5b63a7aeeb4f8d6814fb989b476c
MD5 0a1cfa2fff3eefe6f17dcced36201590
SHA1 7faca88f18529b30aaa94c472402c0e956076c09
SHA512 a3aa95ddf702b8c7f4cd3b0649cf9ceca0e2f04d9cf2bafc9d07b5deb027af8cb72ed19fec3fa15385a6a38dedea5f9f6060bbd7f0ccee0ed419a318cc614d4f
SSDEEP 768:8tJEpBZhjzOzx5+R4s/Hu56HdAbiTinvaTQmIDUu0tiKCj:hD6uukAbiT6oQVkYj
TLSH
T172E21AADF7FA4469C1BD0AB60571990113B4E003D522E77E4DCB28A62B3B7D84B58DF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3676-22-0x00000000751B0000-0x0000000075761000-memory.dmp

Download

memory/3676-18-0x00000000751B0000-0x0000000075761000-memory.dmp

Download

memory/4396-457-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4396-456-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4396-463-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4396-458-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4680-487-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5052-475-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5512-13-0x00000000751B0000-0x0000000075761000-memory.dmp

Download

memory/5512-0-0x0000000001F40000-0x0000000001F50000-memory.dmp

Download

memory/5512-2-0x00000000751B0000-0x0000000075761000-memory.dmp

Download

memory/5512-1-0x00000000751B2000-0x00000000751B4000-memory.dmp

Download

memory/5512-3-0x00000000751B0000-0x0000000075761000-memory.dmp

Download

memory/5512-4-0x00000000751B0000-0x0000000075761000-memory.dmp

Download

memory/5512-5-0x0000000001F40000-0x0000000001F50000-memory.dmp

Download

memory/5512-6-0x00000000751B2000-0x00000000751B4000-memory.dmp

Download

memory/5512-7-0x00000000751B0000-0x0000000075761000-memory.dmp

Download

memory/5512-8-0x00000000751B0000-0x0000000075761000-memory.dmp

Download

memory/5512-9-0x00000000751B0000-0x0000000075761000-memory.dmp

Download

memory/5512-10-0x00000000751B0000-0x0000000075761000-memory.dmp

Download

memory/5512-11-0x00000000751B0000-0x0000000075761000-memory.dmp

Download

memory/5512-12-0x00000000751B0000-0x0000000075761000-memory.dmp

Download