hxxps://wearedevs[.]net/d/Krnl

Analysis

max time kernel
126s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2023, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wearedevs.net/d/Krnl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3332	krnl.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
3320	msedge.exe
3320	msedge.exe
4744	identity_helper.exe
4744	identity_helper.exe
2848	msedge.exe
2848	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1392	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	180	7zG.exe
Token: 35	180	7zG.exe
Token: SeSecurityPrivilege	180	7zG.exe
Token: SeSecurityPrivilege	180	7zG.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
180	7zG.exe
3320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe
1392	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 5012	3320	msedge.exe	48
PID 3320 wrote to memory of 5012	3320	msedge.exe	48
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 4640	3320	msedge.exe	87
PID 3320 wrote to memory of 2952	3320	msedge.exe	86
PID 3320 wrote to memory of 2952	3320	msedge.exe	86
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85
PID 3320 wrote to memory of 4248	3320	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wearedevs.net/d/Krnl
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5d0f46f8,0x7ffe5d0f4708,0x7ffe5d0f4718
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9559314572543270584,15199284529637810117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:3928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5076

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap24940:76:7zEvent28870
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:180

C:\Users\Admin\Downloads\KRNLWRD\krnl.exe
"C:\Users\Admin\Downloads\KRNLWRD\krnl.exe"
1⤵
- Executes dropped EXE
PID:3332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
421032c616e1bcaf4ba5d9ab8aa99a67

SHA1
525092246d2c779bb3bc1a0baaa510d6d3ce710f

SHA256
6e49ce67bf167f17c9cf8ee4a3cc14c25f779294f442d7e40650e0ec1bf12c7f

SHA512
676adfc1bdecd14822d1df0e2476bc514c738305bfe1806f3fe36c3767f35e79f88f727a0c00563cf04fc849eaa63f81e7741c23b6ba3540d18d976d8ef47792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
138e54551676bf75650a02623039fab2

SHA1
0c9f36ef8e4fcfad8711b75bd06ab3e374cdce09

SHA256
f8fa0ff7eb7d1bdde53f6574d16b36aa6730d0228d6049f07efd5acbdae30f52

SHA512
bc3daf1ee62a8e494ae203a9e3f7465e0400b3e0dc69cb02673fc08c7fdfa3f93dc4d31e4632f01e5a547f3a78ab32995d2ec39f56a987c1ce28e2785b43040b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0e140e19677bb5d7cc8c3b6198cb8f13

SHA1
bf0d5df18a3111f51495e29d90734cca81c8653c

SHA256
1b88377cc1279965ee315dcd4e166fc5ca8a707eb46fcf25c2ea68b85d2960ff

SHA512
b061554d565f2fde7b76bcb8f3f186bee4988c53d2e37dd3dc2a5716ca59682543bd9f0d6d1f29949457d95938366e5d68dd02618a0702ead75f3a564f59c67f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2cee7e4f5bcc1cead7471b3849b74ec5

SHA1
92167ad8ab7c920321ee8a1084f185c7135e29d0

SHA256
4dba844d19a42b759b8898727bd50564f57d87939a1842f9ea1465263065b7c3

SHA512
b36a295e9ae05268b56636cff34ac452d15277c9369656f93c9d0c003665980a3e731afbfc5e5ec3fb82d8cd2c54820bc990539c5b92b7d2ae51c7c3e8584186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
14a3407e7607b6e8f35c84cc6cb40e9a

SHA1
cb426bed8012eda92c55dcc7824fa3c076e89e4b

SHA256
e0296880cc274a4f2796fe5fc3fdfb66453366a19147fe960c543e5176ed53f6

SHA512
605a13617a77a41e184c810a7374b609037220f939fa0ab605d9bfa8b02b950a7571b5a30287bffe246e103ac758bc4756b10c4a2c7debd0cfb6e46d66aa6aa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8eb08b95aafb3ea18da0f90031858626

SHA1
d1c428e70f1a4d8b4f21ef3bda56c823c41ecd79

SHA256
9904884163a1ed98c78e16f145a1e2341599c80469aac54d96b071dda33b9e34

SHA512
7e60a4fc42fc1d299db13f8d08551027bb09fc45f89b0d53d124fa884539bdfa9250de0de5b9862e1b3ff7d4aaf997bacd2433a6e0009dc33da4dc37a2967e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ac7df4aa43a957888f802341a5cf91a9

SHA1
4dd3ee625828e3a83afdd961171b5a22a2aefc63

SHA256
0a16fbfa1964176dcab27c5897686e13fcb7f4faa76c986f8b4cd09b92a0d233

SHA512
05bca6880a1e585004a99b3561e1d304765f730f9c1cd76ee4a55d1f0ecc108325d41b7b63556adf0dae331040ea2e3a267dfad9c7f8960bf2c86eee7bff8869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5dae6186cc2bd11a370d948f49ababf4

SHA1
d58319310d278825916500ffd0014d76d2c35e22

SHA256
60b504158e947dcc937d08ffb4f3078465f70c784507afe7b102de6645bbf8d1

SHA512
2a6cd4a5467436c94d55afad4625fd16e5af0a6ab2b3b3f75fd434ffa7b69739c82777676023675060c4bf25e4ebcc64436a7335f026139c243be88feb28baf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5988a22ce25e58383d54a868dffd3369

SHA1
767f0fdabeb82104fef6a3b28f1057977d1186ff

SHA256
7763129e89e32125654faad76ca984ee00d25dcdf6024d3c3685968ff75ed57c

SHA512
a822587eefe83200239f013a2ca91d5f8d1df566631e0ce5a3836814724bcbae521434b18b8c80fca41a91f4cfcedf77dd12dc4cbffd56afab22d26ee17182d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cbe0f5207e52058aa28c07143889a64f

SHA1
a499c7ca1374bdcb3f413060517823ab4a8275f2

SHA256
0dbb61a5e52142272fdd6a2832e1f00e7fe7776e47b0b5200197d69eb19322ab

SHA512
5ef62c210c7213536dc43a0210d52ab9627b69c509b9f45c3f79f56f3d00897d6c050af191daa4c9d3bbfd1961e7a98a988a37a9cbce99fec3e268e25bffa4c7

Download Submit
C:\Users\Admin\Downloads\KRNLWRD.rar

Filesize
6.8MB

MD5
0543fb19e06332230138146e743561d1

SHA1
eda5c083624948c1388ba73c33447c97ddea7f41

SHA256
a5236b3142e898d26bf6f106029a3dafc72960eb4949b1ebb59cac601364fd61

SHA512
e7d934d87b730b484c578f3db648224cc192f292a1f9434a655719015da440b4d15458348a85c2f88d0b6808ae032a3f082f12d1b53fb0a7405425d95f7a358e

Download Submit
C:\Users\Admin\Downloads\KRNLWRD.rar

Filesize
6.8MB

MD5
0543fb19e06332230138146e743561d1

SHA1
eda5c083624948c1388ba73c33447c97ddea7f41

SHA256
a5236b3142e898d26bf6f106029a3dafc72960eb4949b1ebb59cac601364fd61

SHA512
e7d934d87b730b484c578f3db648224cc192f292a1f9434a655719015da440b4d15458348a85c2f88d0b6808ae032a3f082f12d1b53fb0a7405425d95f7a358e

Download Submit
C:\Users\Admin\Downloads\KRNLWRD\krnl.exe

Filesize
1.2MB

MD5
fb3a52d1045b1a0298668f2d77680306

SHA1
e16d5085977f1b895b7b2a046570b2da474add86

SHA256
8869c44219364f911548cb18da0cc6413b3277d3a8a8df18d0a521b558830d6e

SHA512
e19ce4c86ef8bf2ab25b4da67bf83acef5a8e688abfd3f96e8dec8169ce410c833df7685b6fb0b7489cf90ca51c56cd7264e8b2a94865aea5e5dacd4c5b7f44f

Download Submit
C:\Users\Admin\Downloads\KRNLWRD\krnl.exe

Filesize
1.2MB

MD5
fb3a52d1045b1a0298668f2d77680306

SHA1
e16d5085977f1b895b7b2a046570b2da474add86

SHA256
8869c44219364f911548cb18da0cc6413b3277d3a8a8df18d0a521b558830d6e

SHA512
e19ce4c86ef8bf2ab25b4da67bf83acef5a8e688abfd3f96e8dec8169ce410c833df7685b6fb0b7489cf90ca51c56cd7264e8b2a94865aea5e5dacd4c5b7f44f

Download Submit
memory/3332-484-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download
memory/3332-485-0x00000000007E0000-0x0000000000916000-memory.dmp

Filesize
1.2MB

Download
memory/3332-486-0x00000000058B0000-0x0000000005E54000-memory.dmp

Filesize
5.6MB

Download
memory/3332-487-0x00000000053A0000-0x0000000005432000-memory.dmp

Filesize
584KB

Download
memory/3332-489-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download
memory/3332-490-0x0000000075350000-0x0000000075B00000-memory.dmp

Filesize
7.7MB

Download