hxxps://mega[.]nz/file/4R9iRQQB#8ZAw-OY8bC0JngkWUNnNfGe2F5aDCgPyK5vqJBrARsY

Analysis

max time kernel
103s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/4R9iRQQB#8ZAw-OY8bC0JngkWUNnNfGe2F5aDCgPyK5vqJBrARsY

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wfuwDYRdlUBuKwgjPNPzmGIR\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\wfuwDYRdlUBuKwgjPNPzmGIR"	kdmapper.exe

Executes dropped EXE 3 IoCs

pid	Process
4808	kdmapper.exe
5660	kdmapper.exe
960	OrangeWare BETA External.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
3816	msedge.exe
3816	msedge.exe
4856	identity_helper.exe
4856	identity_helper.exe
4756	msedge.exe
4756	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3336	7zFM.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
5660	kdmapper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	2528	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2528	AUDIODG.EXE
Token: SeRestorePrivilege	3336	7zFM.exe
Token: 35	3336	7zFM.exe
Token: SeManageVolumePrivilege	5532	svchost.exe
Token: SeSecurityPrivilege	3336	7zFM.exe
Token: SeLoadDriverPrivilege	5660	kdmapper.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3336	7zFM.exe
3336	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
960	OrangeWare BETA External.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 640	3816	msedge.exe	88
PID 3816 wrote to memory of 640	3816	msedge.exe	88
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 4012	3816	msedge.exe	89
PID 3816 wrote to memory of 1320	3816	msedge.exe	90
PID 3816 wrote to memory of 1320	3816	msedge.exe	90
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91
PID 3816 wrote to memory of 896	3816	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/4R9iRQQB#8ZAw-OY8bC0JngkWUNnNfGe2F5aDCgPyK5vqJBrARsY
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9523b46f8,0x7ff9523b4708,0x7ff9523b4718
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,13743497358148904791,11294356019387402571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\OrangeWare External.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4216

C:\Users\Admin\Desktop\OrangeWare External\1. Load Driver\kdmapper.exe
"C:\Users\Admin\Desktop\OrangeWare External\1. Load Driver\kdmapper.exe"
1⤵
- Executes dropped EXE
PID:4808

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\OrangeWare External\1. Load Driver\READ ME!!!.txt
1⤵
PID:5304

C:\Users\Admin\Desktop\OrangeWare External\1. Load Driver\kdmapper.exe
"C:\Users\Admin\Desktop\OrangeWare External\1. Load Driver\kdmapper.exe" "C:\Users\Admin\Desktop\OrangeWare External\1. Load Driver\driver.sys"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:5660

C:\Users\Admin\Desktop\OrangeWare External\2. Cheat\OrangeWare BETA External.exe
"C:\Users\Admin\Desktop\OrangeWare External\2. Cheat\OrangeWare BETA External.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
1fa0e14d9a605d9a30cd3d0902f002ab

SHA1
1080d6bc917acea7c5d094bc9c6bce0dbb8f657f

SHA256
bbc2d2fe93120aca9d37c08d81e7943fd06fdace720db864e57d79d986c07ecb

SHA512
3a1474d70364673a77c50a7a1464f7829de8a51bb293f64ff58aa1e04fd1cc4b1ba465473a4f77cb1c478bed07acb279cb8b16603612cd7ac83e43e5dd9f97aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
2588ee04231e478d9b74ced2efec33b4

SHA1
2edd1c22979aa7d8f689c636f63d11e8da805f1f

SHA256
a2c12a6b3297ce1f49297a3fef52e69809c20f5f33647f1e88de129d35f51f17

SHA512
3e78a48c609119ddf6789aa00c6cbef424363da1bb7e74e0f8800275b0dbbc8e9997a6704d744d73e9f85a23355851596492e90fbb8dd917b4ca31cba77cf40a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb0914bcf521cef914e04c21baa4b426

SHA1
91310546e9b139308e36551e617cc39632d386a7

SHA256
b517a64f4af4d87cda0338f0dc3c066b3830dd3e6bb55f353a937c8b251fe199

SHA512
03c9034ddc22c35b21da050d61ac8e03cc94a6a3e9605f465a57f14f30c2db5900e0169bf757d6d492572a1c302734abce28b172c8e56a3573c83d653cef5ecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5850f3b09a6e80e6f7cc2a40e5032bfa

SHA1
0575fd5136c923d8433d32509ba8b66e70946afd

SHA256
f7d1c5e1037d316b794563995cf622d6563f4b4b4ffba6599cbee7b19a765973

SHA512
806554e71ed0b264c6893e2fc04dce260f865f4f07f7e027600ea06d8f7cb948f403e993ebcb89cb99053d4ad41dcf26e0c2b1090dd849133aae7953c987a272

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56e8006683c937c738657d4136089859

SHA1
772538274b28d2f92162b4cb9bc0634b03d121bb

SHA256
3d53ba0bbc31322328b2b2ea91522ca0bd2fea7af24c395c9293bd247e20a5bf

SHA512
34c8cf59ce0922e29316e9ca9ee87a6dca3aab6db22f4f77196335bd6e5b164fe951a0b875196601a6bd5d280d46d774ae09a83fd3fe508b487a33ec9bfcd219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc6dfe140b97a836f173b43f91c0dfca

SHA1
730852c301e643ea4e1f220799d30f68f1ee6f72

SHA256
b94ee5da6d6425a3cd9c0ef36bfb0626ba34bbaea6a3ed9438bbf5fc464f3d00

SHA512
2bf5543b4652ae654a9400ed930e41ff02d2298b04196a76d5b56d1874f87fe53837187c0f727572930b966910fffbf6f887e4fcb69144ff8f14f2198b40780d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
181bfc13ad9abb598a92daffbe439001

SHA1
ed8f2d69862a31ec42c0df990c9f81b12cbd287c

SHA256
74f9ec29e473bd601c7561d7295d02d2579fa3e4ea171def818efe314270357b

SHA512
623dd902400955123721d19e45516fb5f38aecf378a5e570d4e9b420d8acd3476e57f64cfad399138b01a3be53f6fc896190670bc2b1d85f6bab86a75ff74500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c1aa.TMP

Filesize
48B

MD5
0b42078d79effac8ffc7a6b7f9bcd0db

SHA1
d0d4f194cb09a2471e348e5ce743ca59d4465841

SHA256
278ea45e8fad889a82a46c1ce018138b9285d3358e9159f622e625d6cfca7c40

SHA512
4fbc34a746d21a6c91b950123ee9032ca11ef5965d81785be7472b55864abd7a25e964b758531ba910b32a36c5e414ab9bec0fc0739e45e0b3f7338eca587d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
898fe42ff7ce10777a26f4db3707de5f

SHA1
a219b5544130c156b2295fa36b068c16f0cc81e0

SHA256
9a96a63380c3c0fb3060169480f36c9389d97dd04e229114b285dfd878925ab1

SHA512
898f091aaa19c0cbbcf8ff8e869026a7bfd4fd27d894d8e3f9dc8fcb068ecfba8e89700da410205ea7d5f03c171c2c96ce3cc12f93519f89fd1451b0cb549b8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c77be39a4e68b721ae5b8ce9c1ed35f4

SHA1
89583f5b062682f906bbe42bb5e1cfc90d587826

SHA256
000353c7fdcdc8d1f171acd6cde3b38e2e39df808ea621d7ed0277d65bb6c854

SHA512
aa7e3d97d760f4d9ec7c8c215814a9421036ed2f39404873560e7c4b167dd70171956cd4eb53801f11cebb207400b8740db8156638523e3e08993b9693738a33

Download Submit
C:\Users\Admin\Desktop\OrangeWare External\1. Load Driver\READ ME!!!.txt

Filesize
87B

MD5
0f52438561a8d8ac6d2d10f52f358d87

SHA1
3413f3fc90d8d999351d09d115c65d6aabc37d7e

SHA256
d9b4b4e036283fd7df6a39dadf10c616672d8322c648edb935f0053fad2ac981

SHA512
27eeb7e0ff416c18a36a7a3a1c3949de72aeb1e189fea717be6494fa7dfdce47a4d399df8587a6ce9b42b5e3cbdb2d67be2d138e9227b4864d65f5cf3b4cf399

Download Submit
C:\Users\Admin\Desktop\OrangeWare External\1. Load Driver\kdmapper.exe

Filesize
140KB

MD5
3fc20a08f109a354ee1442c6243dcccd

SHA1
0ccae8dba7179f6eba6b91cab5d7ca7cc26a80c3

SHA256
5c256414011636f91117468a8c97ede860df32143210f43c0e00dd8c123b1c0d

SHA512
edcf714ed9855f890489fffbe7ef847465b97c79f41037dfac29e5b5222066a0b178e515f82a4c8bec58bd5364a48b7217744998b5266f66da4e4a9c4ef757cf

Download Submit
C:\Users\Admin\Desktop\OrangeWare External\2. Cheat\OrangeWare BETA External.exe

Filesize
621KB

MD5
134f20694087181c8cb385893b0f03aa

SHA1
54e9c011c212f06f3ce30bb1f9b1103603422ae9

SHA256
c8d83e6b383023c0f9fa59ed1eeb93916234d634bda6c322feb2d3277acd5c1a

SHA512
f1b26f7829fd1079c7e11e35bc5d7edd15a2d9ecf153019118531fb9f85b4ad3c50aa4ded1c6bfcdf80796b198d1386e57b93ec665594817ba33c2da468b67e1

Download Submit
C:\Users\Admin\Downloads\OrangeWare External.rar

Filesize
276KB

MD5
7dd36b82c99ebbed3fb8876dcbdb105e

SHA1
4dfee71c0d2547bf58d9dd585edcc1d259f9374e

SHA256
3e2cb202ac11728f1ca184ff26fd7032f92d364f11de9f3c3a1a931206a4246e

SHA512
e1e6cc14c48d1142ccb180a97fd85e8dcaa97c60db0e28269e56b0d84bffbdf22fb75a51f6618d73fedb6cf40a36c787e88e7fa0cd49a73bddddbebee1f6c876

Download Submit
memory/5532-249-0x000002693D000000-0x000002693D001000-memory.dmp

Filesize
4KB

Download
memory/5532-266-0x000002693BB50000-0x000002693BB51000-memory.dmp

Filesize
4KB

Download
memory/5532-252-0x000002693D000000-0x000002693D001000-memory.dmp

Filesize
4KB

Download
memory/5532-253-0x000002693D000000-0x000002693D001000-memory.dmp

Filesize
4KB

Download
memory/5532-254-0x000002693D000000-0x000002693D001000-memory.dmp

Filesize
4KB

Download
memory/5532-255-0x000002693D200000-0x000002693D201000-memory.dmp

Filesize
4KB

Download
memory/5532-256-0x000002693D200000-0x000002693D201000-memory.dmp

Filesize
4KB

Download
memory/5532-257-0x000002693BC20000-0x000002693BC21000-memory.dmp

Filesize
4KB

Download
memory/5532-258-0x000002693BC10000-0x000002693BC11000-memory.dmp

Filesize
4KB

Download
memory/5532-260-0x000002693BC20000-0x000002693BC21000-memory.dmp

Filesize
4KB

Download
memory/5532-263-0x000002693BC10000-0x000002693BC11000-memory.dmp

Filesize
4KB

Download
memory/5532-251-0x000002693D000000-0x000002693D001000-memory.dmp

Filesize
4KB

Download
memory/5532-250-0x000002693D000000-0x000002693D001000-memory.dmp

Filesize
4KB

Download
memory/5532-278-0x000002693BD50000-0x000002693BD51000-memory.dmp

Filesize
4KB

Download
memory/5532-280-0x000002693BD60000-0x000002693BD61000-memory.dmp

Filesize
4KB

Download
memory/5532-281-0x000002693BD60000-0x000002693BD61000-memory.dmp

Filesize
4KB

Download
memory/5532-282-0x000002693BE70000-0x000002693BE71000-memory.dmp

Filesize
4KB

Download
memory/5532-248-0x000002693D000000-0x000002693D001000-memory.dmp

Filesize
4KB

Download
memory/5532-247-0x000002693D000000-0x000002693D001000-memory.dmp

Filesize
4KB

Download
memory/5532-246-0x000002693BFD0000-0x000002693BFD1000-memory.dmp

Filesize
4KB

Download
memory/5532-230-0x0000026933A40000-0x0000026933A50000-memory.dmp

Filesize
64KB

Download
memory/5532-214-0x0000026933940000-0x0000026933950000-memory.dmp

Filesize
64KB

Download