njrat | hxxps://gofile[.]io/d/RwFo7tsO

Resubmissions

24/10/2026, 22:36

261024-2jae7asv7k10

24/10/2026, 22:30

261024-2e1rkscx7t10

Analysis

user interaction
yes
max time kernel
296s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 22:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gofile.io/d/RwFo7tsO
Sample261024-2jae7asv7k

Score

10^/10

victim defense_evasion discovery njrat trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

5.tcp.cpolar.cn:11548

Mutex

bdf05ca063173b2d8f0673df1a3fe649

Attributes

reg_key
bdf05ca063173b2d8f0673df1a3fe649
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
49	1260	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes a file named after a Windows system binary 1 TTPs 3 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\dllhost.exe	dllhost.exe
File opened (read-only)	C:\Users\Admin\Downloads\svchost.exe	svchost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\dllhost.exe	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
2776	svchost.exe
2308	dllhost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	api.gofile.io
27	api.gofile.io
30	api.gofile.io
35	api.gofile.io

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	dllhost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dllhost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1260	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{C284BB2A-3BD7-4D42-9DBA-7D87D731683D}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{122CAA28-0FD2-4A05-9369-74CEEE64E202}	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe
2308	dllhost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe
Token: SeIncBasePriorityPrivilege	2308	dllhost.exe
Token: 33	2308	dllhost.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 1280	3444	msedge.exe	87
PID 3444 wrote to memory of 1260	3444	msedge.exe	88
PID 3444 wrote to memory of 4472	3444	msedge.exe	89
PID 3444 wrote to memory of 4472	3444	msedge.exe	89
PID 3444 wrote to memory of 4472	3444	msedge.exe	89
PID 3444 wrote to memory of 3056	3444	msedge.exe	90
PID 3444 wrote to memory of 3056	3444	msedge.exe	90
PID 3444 wrote to memory of 1912	3444	msedge.exe	92
PID 3444 wrote to memory of 1912	3444	msedge.exe	92
PID 3444 wrote to memory of 1912	3444	msedge.exe	92
PID 3444 wrote to memory of 1984	3444	msedge.exe	93
PID 3444 wrote to memory of 1984	3444	msedge.exe	93
PID 3444 wrote to memory of 1984	3444	msedge.exe	93
PID 3444 wrote to memory of 2000	3444	msedge.exe	94
PID 3444 wrote to memory of 2000	3444	msedge.exe	94
PID 3444 wrote to memory of 2000	3444	msedge.exe	94
PID 3444 wrote to memory of 1208	3444	msedge.exe	95
PID 3444 wrote to memory of 1208	3444	msedge.exe	95
PID 3444 wrote to memory of 1208	3444	msedge.exe	95
PID 3444 wrote to memory of 908	3444	msedge.exe	98
PID 3444 wrote to memory of 908	3444	msedge.exe	98
PID 3444 wrote to memory of 2592	3444	msedge.exe	99
PID 3444 wrote to memory of 2592	3444	msedge.exe	99
PID 3444 wrote to memory of 2732	3444	msedge.exe	103
PID 3444 wrote to memory of 4624	3444	msedge.exe	106
PID 3444 wrote to memory of 3288	3444	msedge.exe	107
PID 3444 wrote to memory of 4624	3444	msedge.exe	106
PID 3444 wrote to memory of 3288	3444	msedge.exe	107
PID 3444 wrote to memory of 3288	3444	msedge.exe	107
PID 3444 wrote to memory of 640	3444	msedge.exe	108
PID 3444 wrote to memory of 848	3444	msedge.exe	109
PID 3444 wrote to memory of 848	3444	msedge.exe	109
PID 3444 wrote to memory of 2776	3444	msedge.exe	111
PID 2776 wrote to memory of 2308	2776	svchost.exe	115
PID 3444 wrote to memory of 4648	3444	msedge.exe	121
PID 3444 wrote to memory of 2976	3444	msedge.exe	122
PID 3444 wrote to memory of 4308	3444	msedge.exe	123
PID 5524 wrote to memory of 5556	5524	msedge.exe	129
PID 3444 wrote to memory of 1292	3444	msedge.exe	134
PID 3444 wrote to memory of 1292	3444	msedge.exe	134
PID 3444 wrote to memory of 5812	3444	msedge.exe	136
PID 3444 wrote to memory of 5812	3444	msedge.exe	136
PID 3444 wrote to memory of 5344	3444	msedge.exe	137
PID 3444 wrote to memory of 1688	3444	msedge.exe	138
PID 3444 wrote to memory of 1688	3444	msedge.exe	138
PID 3444 wrote to memory of 1244	3444	msedge.exe	139
PID 3444 wrote to memory of 1244	3444	msedge.exe	139
PID 3444 wrote to memory of 4360	3444	msedge.exe	140
PID 3444 wrote to memory of 4360	3444	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/RwFo7tsO
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffca980c188,0x7ffca980c194,0x7ffca980c1a0
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,3869481239917387191,17992329873933800313,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,12847702678402821895,5287444708619438586,262144 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,6590311111505714724,9153290154373134647,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,17378226313429211688,5378130989970721225,2097152 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,14932967890889950384,8998601298602673646,2097152 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,7044625847640110029,4298733225444281783,2097152 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,14224005125786350362,4067935535140415589,2097152 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,12216434136292975492,1262206585177762918,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,177673901920390315,6485312523529950803,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,17251460009570016891,4821565382237317252,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,17251460009570016891,4821565382237317252,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,13247446277138505899,1518605871358603937,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6320,i,13003422401482533989,14908120896173924091,2097152 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,10300764891089803972,10764215648447501427,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,9357098322260713233,7618276069039600094,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:848
- C:\Users\Admin\Downloads\svchost.exe
  "C:\Users\Admin\Downloads\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Users\Admin\AppData\Local\Temp\dllhost.exe
    "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
    3⤵
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Enumerates video capture drivers
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,6049646311383479194,14595021769009804855,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,7155267749729783433,2310899280602405919,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,5386604046526420500,2027339894862316348,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,13478057990685858187,8385638495563223675,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,7495660081109815726,11791612888563936513,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6120,i,9974688810206190981,9673974809368869735,262144 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,15842016431031187849,8257300128581344407,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,15088221320891391232,18064110735194476920,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,9334721043815364714,1747633034290236860,524288 --field-trial-handle=2304,i,14681197256281814910,17485189322229934471,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2a5f988bh097dh4fach986fhf44922ddaa22
1⤵
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2a5f988bh097dh4fach986fhf44922ddaa22 --edge-skip-compat-layer-relaunch
  2⤵
  PID:5556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault0dbe03d4hcc5ah4fd9h88cahec046dd9bc70
1⤵
PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1d0ea4e3-d2a8-4f2d-86d4-82f68340de89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d0ea4e3-d2a8-4f2d-86d4-82f68340de89.tmp
Size 26KB
SHA256 22c42ef212ea5b5da656a4c64c7526087f02e7e7a588169f51df7c4eec9d7cc2
MD5 56da297ea8d1e7a4ecdd2e080b0b0ec6
SHA1 7416f1d686efabd97f88c457d4d88c89045b2624
SHA512 8da1167789cf6960eb4450d2cc55b96834643954b7699e764a51793357165109ffcacc4f878b1c366b7500f9a7afd32632313e71de41fc9b64080b02da934c2c
SSDEEP 384:ciFgQkUSvulsN58TUNTUlIlGZb+Ihh//TyzzL2ISIIl/:HFIggwgmP/byP5SLB
TLSH
T1C4C208F658D79836D9AE9B43A33E2D038E7CC163B5845A54B3C9591CCCC61BFD20B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38c075f5-f59c-4d32-97aa-9f94e138e5f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38c075f5-f59c-4d32-97aa-9f94e138e5f9.tmp
Size 18KB
SHA256 aa1b7180a6175dac5a9b1423d5f6dcafd93d0a025a16c1ca24f91443c7c1b689
MD5 066c7c7a39469eb50bbb54fd76fbbe84
SHA1 93f7c4b31309e72a0182e071a40f4097c83e0a6b
SHA512 14752d95fcf74d310c93481a8512d5edb52ee75bd8fb75319069f6d421a9ea9f6c14f36d644bd2d1312396d3c3fdf273cb5e847a533543718782a9d084f56eda
SSDEEP 192:uumULHcP1cZLxRm88SvjiVEsNnYbQd1UbnAQmiU1Hb+4h//TetKaoAqZLN6DFKAT:vQkUSvLsNnGZbARhh//TyUzL2ISIIl/
TLSH
T174826C35AC686C278EA7E540F14B76038EB49127EBC85FA4D6DD6B1D05CA2DC230BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8aac151d-451b-4389-b708-39e9b884a9c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8aac151d-451b-4389-b708-39e9b884a9c2.tmp
Size 8KB
SHA256 6474e5d0628a5fef54c1151ca656011aa23c625b171f37706f428e3719754ea1
MD5 197531275b3bf4b7cc3eb99a5a69718c
SHA1 ca7286ec5183375055e2c237db12663e92b05ca7
SHA512 6bf8adb43031d19d81f20cfa650d76b9e0b3ef525e7acd99ca0f0b334bc8d367dec9e04b2bd3e007101a247fdda4041a1598d530dee882525ed2aeae84105bc9
SSDEEP 96:dqONkuQsjpfbUGH5ih/cIPURHl8h4otop5MVDiBjP4v+Y1xf//ojdoxyqsoe8x2r:UON66JUdQmiUyciTo//Tet9NxAqZLU6
TLSH
T104120A35B878AC7B5EA3A944B08736138E644137EBC56F94D6DC2A1C05DF2AC630BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

50cb5220-c159-4a85-a453-4ea6a175ada2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50cb5220-c159-4a85-a453-4ea6a175ada2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c0f117f-e2d6-4898-abd6-0f2a87f70096.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5c0f117f-e2d6-4898-abd6-0f2a87f70096.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

81308a7e-4f3f-4d28-837d-cc98aa86e286.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81308a7e-4f3f-4d28-837d-cc98aa86e286.tmp
Size 27KB
SHA256 8f2f63db15ff9dada9491b51562ccc4eb7d504582038d2bd8b5a942a55ca2ac0
MD5 d9dbe525c47da1c1a9177e53756d2f23
SHA1 98d1b642116a6520e168f94f53e82f8eae485833
SHA512 9fedb4bcabb5c727667adb54f44cbfbda9ef2ef1a3a573ef0ca7d4e6261e5ead7f3bec6f6b2e673959f6f2109ecc8df99102b4a4c64fcd9eb41e898d35bfc13a
SSDEEP 768:lRKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/mrolV:lRKlm7QWvUYe0u1ja8/L/E/dlV
TLSH
T1C2C2FB3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91084146-d62b-4105-8513-77199ba86529.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91084146-d62b-4105-8513-77199ba86529.tmp
Size 10KB
SHA256 7656b9a0091243bb5ab1559e03c952551b2527eeec6e22b58da7c1c1b7b138e4
MD5 37f23dacf8687ef496733c12930b5bb6
SHA1 93e91a31bff3ac99a41ad4b21e10094ab6d975c7
SHA512 02c970099acc5ca4307e5876c20ab0030a3fe207ce3861ca66a46d0caf7bda79ce234eadb96005b29081a540a91cd820053611b0fb95b9c5b3cd95fa56630f41
SSDEEP 192:sxZMROnz/fAsg5hIdpjlngHW6+WNen+ozQ/Y36c+tnJKWIgrJ:sxZM6z/fAs0K9gHbq+4Q/Xc+b9
TLSH
T14D22B9516E38A93B8CCBD20DBA25BF13D5FA5032A5D11E58A6FC861C05E66DE120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f3df16fe52b1131d644f732eed8459346646187959170a4ce5484800bac1d2c6
MD5 2a5e91b08c20170400dcc5808fde2f6b
SHA1 357f0996a2fd2444cf0a7716ce729dfc3891aac1
SHA512 5ab04047a19c3565472eb14d2599fb079a6204e3fe1cae3001e6289e95739fbd255dc5fb9ecd0e7c6f7f23a2bc8cbc89706602549f890b231d00b722b6789a5d
TLSH
T181E0208458D4C33DF305A89782D9571C83C02A2A96D0EE2D7702C9C47649891E2E15E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 de43aa610cdd297b19fb43e2f63a6e4f04bf5c8dab3de7c492453782ead5dd0d
MD5 ac3212f051054021f117d388cba93702
SHA1 0b158e04606c880126dece428d2b7008ebdb79cb
SHA512 aa488010f54b81388dff20854dbb256237d1e269ded0a5d3dcffb80f2414314e8270866e8bce4c8999c04322df07d0bed0c15a8e5f005a8ecc3581d037a6adc2
TLSH
T142E0268814C8C32EF20AAC9B026C570C8380372A92C0E95F1B08C586728A948B2E7BE0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 b730d3977f4c6ab2b3be945c976fb81d9606ec412ad7f8da1b13b0c3d3cdfe6f
MD5 40f860602c41e10d132e5e5feab900ce
SHA1 0011cefd86d981159b3a97a255807be294ff5851
SHA512 3dbc4ea920fcc48573aa31e303d7442b7f793909269846887e25b77e7ea2341836ed8d2d19ed9b7c1e5bf190d44d479c2c9ef970b0f21fff0c74b56af6e54a59
SSDEEP 48:toAyM34FdRe6lG+N3PTARmr1/ni754M7oeMfgoSRGSoAQLdHiiHVjD777rDNhr:toAZ3kC6ldNURmrw777odfgoXp5H37Dn
TLSH
T17D9161C5E92301ECE79B42706CCBE9577A3858B245432D5B0BD6C47B0B0E79A0DEB344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc53c9c6-f275-4829-a3ca-c7b8771180a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\fc53c9c6-f275-4829-a3ca-c7b8771180a9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

190264fa-75ea-488a-80fb-3e0be911d564.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\190264fa-75ea-488a-80fb-3e0be911d564.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

2ccc4887-7f7a-440b-9138-aa25a3e8bca5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2ccc4887-7f7a-440b-9138-aa25a3e8bca5.tmp
Size 1KB
SHA256 5418f6b2d77c340d9869743cb04766b4edc82552e2b53b690a8029c2392cfeba
MD5 b203e20950d83970eefbbeed479f0174
SHA1 93af350bf01c61bdf796e362d34203095d497a35
SHA512 28cc49694dc69c4770d0e5ed415eee06945f5268c60f03a81e16b3b00b851c321bc696c9420b715d856eb5f300c242366616b8d35f69b09c5d440006eb06252e
TLSH
T15121BEF3C3E9956E892556F09E14AE1BCE1C0505832C7D29C9D4AE17A3E3471E10165B
MD5 SHA1 SHA512 TLSH

Submit Download

c2a9a9c8-1d2d-4f49-a41f-5a6e63a0cd83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c2a9a9c8-1d2d-4f49-a41f-5a6e63a0cd83.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cfce3c2629ccb7a189f467ab44a0cc8971f33eb2559a2ba46b33a119df3967e8
MD5 a62f0f7845687857e982827c0bfea6f6
SHA1 a0a8591b128dab45f9aedda2aa5bd7b3601f87b5
SHA512 4b1a9af246af54a475cd60bcf3516ae4def8870a9e4a45e30a2ce81553359a4505855eb811246b8023a9bdc58f5d620b3a4d0cbe338de60bd1997ca59a156a2b
SSDEEP 48:K0q1YEqo4pb0TkIS8pK9g1apxS5YrMYayL2xMwuUUNb4PgISINK9s1uNxmdYHY8c:KIRyKqoy+h2KyQ5a8K7qKR
TLSH
T1E7916C00317B42117A7E7A4C80B99B3B46423172344AE62B7FB951B28F6EE104EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0537515-ac05-4b5f-8abf-25613df39bff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a0537515-ac05-4b5f-8abf-25613df39bff.tmp
Size 10KB
SHA256 44d8a083d1b8c4c18081e552039d9692617444276986d9877d15284b7d4add3e
MD5 7c4d22837a412cbc6d7cbc2025f981f5
SHA1 393a98740cc34f58ea1d1096cd7607782eeace3f
SHA512 c8aa7b468d0dbadea7548d35fb49edfa8d4179779e5077bec5b1f9b899aebafd12ab14a51f8db7378dffcbc46be413bcee903b55d6ec240d532fee025e386fd7
SSDEEP 192:sxZMROnz/fAs0dhIdpRlngHW6+WNen+ozQ/Y36c+sh6JKWIg5RJ:sxZM6z/fAs4KrgHbq+4Q/Xc+dV
TLSH
T1A432CA51AD38693B8CCBD20DBA15FF53E6F95032A5D11E48A6FCCA1C05E66DE120B90F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7721ce9-a610-42c5-bf49-07717bd73d6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7721ce9-a610-42c5-bf49-07717bd73d6e.tmp
Size 10KB
SHA256 ece5ffa781539f526b4d49db00c1e0f93348d4955a45223c0d250e579f6a8422
MD5 4700f083be7ccd0ec6898609738f444a
SHA1 044c49ffbd05200e9a7fd09b58cd4dd3a3f77faf
SHA512 58bf44a0573904ba7d5e45cdad05dbd44c1845d4e466a9e33ef5aa58c40d009a0085ea71b8ede2710d766ee4a6f55a68ef516ef2529da8b3e52c631becae2b05
SSDEEP 192:sxZMROnz/fAs05hIdpjlngHW6+WNen+ozQ/Y36c+taJKWIg5DJ:sxZM6z/fAs4K9gHbq+4Q/Xc+wj
TLSH
T15A22BA51AE34697B8CCBD20EBB15FF53E5F95031A5D11E48A6FC861C05E66DE120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d23bf0e4-4c46-462d-8acf-22aacc40efa4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d23bf0e4-4c46-462d-8acf-22aacc40efa4.tmp
Size 10KB
SHA256 0763e8534f064f9a7bbe4773397a9e95b1784adc40579411f9223c24b3ee5fee
MD5 ab498d8a9c19d0b98aaa733b7c9e8759
SHA1 53fdb3c623819267b4fd940e55a9d1048c9c856b
SHA512 71747bc79678736c6afce6552832795434a35cb7ce69a36cd79ca668d32b49f88473bedf57a498ab7b9cdc10a81b02926663f2e2caab217587df6ade85f0bbdb
SSDEEP 192:sxZMROnz/fAs0dhIdpjlngHW6+WNen+ozQ/Y36c+chjJKWIg5RJ:sxZM6z/fAs4K9gHbq+4Q/Xc+SV
TLSH
T16022CA51AD38693B8CCBD20DBA15BF13E6F95032A5D11E48A6FCCA1C05E76DE120B90F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

fef88f2e-55c5-48a4-b9ac-077083278864.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fef88f2e-55c5-48a4-b9ac-077083278864.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a30eaf3a-7ecb-45d3-9884-85abcf268d97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a30eaf3a-7ecb-45d3-9884-85abcf268d97.tmp
Size 8KB
SHA256 9d720bfdd02ec1e5fa1d07a794384c18eade72a498bbb31e9d6ad9f0c61400bf
MD5 a0d30ee09354a7b548c833985309331f
SHA1 f676b1c45f668a2f191f1636d9d347f8619c196a
SHA512 cdb201fb55c88e66a396d79eac48fb7179e99592547d2e56670214164ee9adebb6753cad41cc30dcfc957d5e6da4107a171a8a90ee0d5f8d9b4c150c8c0268c3
SSDEEP 96:KqONk1QsjpfbUmjH5ih/cIPURHl8h4otop5MaDiBKP4v+Y1xf//ojdoxyqsoeQBo:BONl6JUm0QmiUytiso//TeQBC5VU6
TLSH
T18202E839BC786CBB8EF3AE45B08777239FA4106BA6912F84D6D85E1D00C725C2303D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6862c5e-f1a0-417b-94c9-15c1cefd0c03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a6862c5e-f1a0-417b-94c9-15c1cefd0c03.tmp
Size 18KB
SHA256 6a374097553e1315e3f27f3ca4fbf5f725ee7071885474b9f550d9e4a3575a66
MD5 58b3285e7de447ee583352425e97ca8b
SHA1 1f7866ed30ca811907cc9b6f6ce9128e9ab65db5
SHA512 5bf9b6718032a554f2f0c6650e3e880d025c8bd6bf6b9fd385c5af0c0f7b1e8f7b5b64b5a7756fb275065fe46692769725dba22071aba1bd5890cfbd3e426941
SSDEEP 192:ugxULHcP1cZLxRm88SvjiV8sNnYAQd1UbnAQmiU1Hb+4h//TetKaoAqZLN6DFKAT:aQkUSvXsNnvZbARhh//TyUzL2ISIIl/
TLSH
T15E826C35AC686C678EA7E540F14B76038EB49127EBC45FA8D6DD6B1C05CA2DC230BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9b7963d-ea30-4486-b971-88df28e43779.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b9b7963d-ea30-4486-b971-88df28e43779.tmp
Size 18KB
SHA256 bfe72fd0a5f675e5556abf2ba1753822a1390939258fcf24ae56f98f53a85fd7
MD5 1c8c00272effc6b29904cc62a9391bf1
SHA1 11804b2e76c9b283d8d3f73390a51842b410ab92
SHA512 05c4e87976ce7470065b48774aeddf8feb39fa5ef76284ca623dc283691cde00a2932ca8a592484c0634f97045762f91373a025fa08989510c68f223ef2e7bca
SSDEEP 192:ug2ULHcP1cZLxRm88SvjiVfsNn7Qd1UbndQmiU1Hb+4h//TettaoAqZLN6DFKAgE:NQkUSvAsNn7ZbbRhh//TyJzL2ISIIl/
TLSH
T1DF826C35A8686C278EA7E540F14B76038E748127DBC45FA8D6DD6B1D05CA1EC230BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7212c8d-2b80-4f11-b44a-a4fbdc420adc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c7212c8d-2b80-4f11-b44a-a4fbdc420adc.tmp
Size 18KB
SHA256 8d5ab515de886b007147bf52b502099d8049f6e0c311c20d947e4c2722e2c956
MD5 631b94c0beb1172225f9460e3f279839
SHA1 552e351e6e7db5da96ada55fbf53b918f6cc395e
SHA512 a303b287e34ab4eed2db8ca2c6c9f736c6c164dcb7f26592dc79698c4d22797bf29a319826ce3adc1ae853864fde317a05e5d18e85df99c25077786b372eaf55
SSDEEP 192:ubjULHcP1cZLxRm88SvjiVJsNnYbQd1UbnaQmiU1Hb+4h//Tet5qoAqZLN6DFKAT:pQkUSvqsNnGZbWRhh//Ty9zL2ISIIl/
TLSH
T114826C35AC696C278AA7E540F14B76038E749127EBC45F94D6DD6B1C05CE29C230BE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

436cedf3-194b-458b-8f5b-ae91a51ce2bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\436cedf3-194b-458b-8f5b-ae91a51ce2bd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d0c1fb74c7a2cc5d340987b651c6a261d52badd446d103e81be10a7e34242dd7
MD5 3d97d617992362d4e42d76b07ebb1bda
SHA1 eb7db5ad5c9e5f3e07c8256f3df80d51255c44b0
SHA512 b96909ac92276ed573e8108be63eae704d91ee828bf398b5cb0de39ffdb76ae3117803e04624fdcbeda5e38c0775d5ffec1e60d6fe24911991fb207a0cd78957
TLSH
T1E4413858B6FA5048B3777F5AABF6A86D487BBD772E0AE55D00110E0E0A22B40CD71737
MD5 SHA1 SHA512 TLSH

Submit Download

ec28b1dc-70de-446b-b5c2-fc782f4f6c75.tmp

Path C:\Users\Admin\Downloads\ec28b1dc-70de-446b-b5c2-fc782f4f6c75.tmp
Size 15KB
SHA256 7c84f5a3d0fe72f892fc7dff4a0b3df57ec028bf6c60fd4b2e8010e1886f7a33
MD5 d14a82e7b689280b4e25b76b2f205869
SHA1 893151b471dd2eeefedbd2e5f4012789aecc5b63
SHA512 339609f5d80c4a8cb56d4ef41027641011668c152cefeccd871ace1d745df18c9a65da19efd97278efb8af90c4e7fba80f6183cf568d6a04da7d272d568a1230
SSDEEP 384:r5YgICUpEMbl+zJ1M3KhhUNbS5t7t2Nho6Jq:rKPCUisl+t1ManUU5n2Nho6Jq
TLSH
T150621E8A7F9A998AD37C8B75A1F21538457409A3F452BE1F8CD6ADE363266C31804DCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe.crdownload

Path C:\Users\Admin\Downloads\svchost.exe.crdownload
Size 54KB
SHA256 270f01d9864fb6a516bd7f0865befa0cf7a06edbb8a0e97f7c69d0b49e294181
MD5 ec10e6cfb28eb6094bfb1ae8423cc71d
SHA1 78dc99bc5f98230b8b536d31b7601c821b7274c8
SHA512 dbd3bd5f5abace06ea07ab250812df3f8bc99a480bf7ed6b63c71c9e88d8fd5651bf1c978f4c5f835f9f4930459210a48d68c5bf2d16be98669e1defa9270341
SSDEEP 1536:rKPCUbsDnyNho6JypySDxwsNMD1XExI3pmOm:ruCEsDn4o6I4SDxwsNMD1XExI3pm
TLSH
T1BF432840BFEA5A05D2BD8F3468F655150634BA63EA32EB1E4CD668EB13327C58C40FD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5756-339-0x0000017C99DF0000-0x0000017C9A519000-memory.dmp

Download

memory/5756-338-0x0000017C99DF0000-0x0000017C9A519000-memory.dmp

Download