hxxps://github[.]com/osmancitci/GrandRp-Farm/releases/download/New/Potum[.]exe

Analysis

max time kernel
1045s
max time network
965s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/osmancitci/GrandRp-Farm/releases/download/New/Potum.exe

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5928	Potum.exe
5416	PotumV.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00020000000229b0-37.dat	upx
behavioral1/memory/5928-77-0x0000000140000000-0x000000014013B000-memory.dmp	upx
behavioral1/files/0x00070000000234ba-98.dat	upx
behavioral1/memory/5928-100-0x0000000140000000-0x000000014013B000-memory.dmp	upx
behavioral1/memory/5416-99-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-124-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-138-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-141-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-147-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-165-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-189-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-208-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-211-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-230-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-231-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-234-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-261-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-284-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-305-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-315-0x0000000140000000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/5416-339-0x0000000140000000-0x0000000140151000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
112	raw.githubusercontent.com
113	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 306812.crdownload:SmartScreen	msedge.exe

Script User-Agent 8 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	113	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	138	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	195	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	353	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	488	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	507	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	82	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	84	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
4900	msedge.exe
4900	msedge.exe
512	identity_helper.exe
512	identity_helper.exe
5808	msedge.exe
5808	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5416	PotumV.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
5928	Potum.exe
5928	Potum.exe
5416	PotumV.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
5928	Potum.exe
5928	Potum.exe
5416	PotumV.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5416	PotumV.exe
5416	PotumV.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 2436	4900	msedge.exe	83
PID 4900 wrote to memory of 2436	4900	msedge.exe	83
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2848	4900	msedge.exe	88
PID 4900 wrote to memory of 2992	4900	msedge.exe	89
PID 4900 wrote to memory of 2992	4900	msedge.exe	89
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90
PID 4900 wrote to memory of 2932	4900	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/osmancitci/GrandRp-Farm/releases/download/New/Potum.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb371b46f8,0x7ffb371b4708,0x7ffb371b4718
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5808
- C:\Users\Admin\Downloads\Potum.exe
  "C:\Users\Admin\Downloads\Potum.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5928
- - C:\Users\Admin\AppData\Roaming\MrafPrDnarg\PotumV.exe
    C:\Users\Admin\AppData\Roaming\MrafPrDnarg\PotumV.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,8100337119623423489,5936583930990890548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
075426dee6a117f23f59880ee0f41843

SHA1
9dd4e4a9b7a69aefee90538ed884c8baf65ece0a

SHA256
817550a8bd570fc36b5419c23b2737b32b38578e8b5fd442f1c005673141e618

SHA512
08e134370593cd081a583fca9573c547f0c012908497ae53c01e0bd13fa452a9b3839e2fd68eb1cd2307483396650c9efc2618e1a216facae3da95a387184daf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce4178cff39f35857a30b1eaf139873a

SHA1
6ff511674749aac99c57f75a16a023ca5fd4c8e8

SHA256
e1b5afbd2244d6e9c12fd80213d535459ce0bf21032d3564fd839dc019fd6070

SHA512
90a946cb780eb4c83d1db35299963573b8f83d8c9e7e02c37a2138e8deed23959dc0a25dd30b525d974a9e6b273fdcb553c87816b3fb1d328cd745948bde0bec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
76a57f7153c284af7200e059637c3439

SHA1
89478f45a72de0890b36855b2b531ef274efd822

SHA256
cfde1dde0f2e24f130e99231170e6ebeb2f9bc0a69e68f95672910751c259980

SHA512
29d6d816afe48e0e47b72fd2f9f848d414714191320b1f87460dc9fa16ac51604d2aecaceebda8b3b82db1bf5ed2fee0634f275d8f8adac732e9c226096554d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c65e4d8facd3aa8ce779773227ec5b47

SHA1
8781451dc0ad87562e7df5a308464b4130513cd8

SHA256
aa3c974579dd8ef3b4b2e089088e998184fcbe567b7d4f7159bdc63cb5184407

SHA512
ff7010d528ac5f987b8a51bff4f07314e09c6e17f8fe910960bb2be8f1b6549b9db3a2edb1227eda06196f06d4947188a82588c0c019d2b9b72a62a83f6b6241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed573e9725feaa3ea9b2ef09df452527

SHA1
d02a5d1b603481cff616c91fe4067b85a27fe12e

SHA256
9f5029a0bd087364f4b8fcf10b8b1b84fb3cb52e05698de1a0024b6d5b723cb4

SHA512
2f5570be361efe0e1105826729206ecf889f154156420b7d2e3c230491c9537428e9452843895319efccecda6f0f6ea51fad51110d826512a5cef2bff7b1f396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1f264a1c42186d4ed9228541d4e7087e

SHA1
ba77efebc687a5f89877a53e5853bd1b931f32db

SHA256
cd1d11092d4b04512d7266239329f9a7a8521ad97be4ea49c07ef3360346e482

SHA512
490c6e3bb47d9d41d2ba29d2977229f0b4459151e0ab9a8e8db26d626bf14790bd2321c5f4d422edd67c49ee45182180e533e134235b6529bb7bea26b906aaac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
092ca5bd6b8cc86f67865ccf59485636

SHA1
f02eccd732b6c8926c58d2c285d3ee0e7829c1bb

SHA256
6610f70324993858515660cdd83fdd4bd52c2aa8e276c3125705d6632d8ca8c2

SHA512
c9b21c3a575fbddd454717464480ac5a57bc7b976a21e83161bfb0bd48d63676d3c245050077e0e4c22bfea78013d044e7bb7a63fe4f2ad938ec7f6349be63e2

Download Submit
C:\Users\Admin\AppData\Roaming\MrafPrDnarg\PotumV.exe

Filesize
467KB

MD5
d31f38ac2b22d172cbbb6a580dc62123

SHA1
c9073b21c14cff9071e924c0dcbfca522b11815b

SHA256
ecfa0ea7d007869bcdbd757b61144950f5e24aa6939d7c49f7f7fa91bfa384dd

SHA512
5ec2ab84a31ac05e79f78466f7a7473b9cabe687ed549eae0c08c7f6556fc7b02109c9c3bc44db0d5892b1e7c4fc7856aabbdee47d4f751b984351dd34646b65

Download Submit
C:\Users\Admin\AppData\Roaming\MrafPrDnarg\settings.dat

Filesize
52B

MD5
1a7cadf9984f6191d5aec4d684f7e764

SHA1
8718309b044a57f24bdd8477f33ae50a1a883ef5

SHA256
fb2fe08a09b8f3db446c92b542cba78703dd2dba36c157eabb221cff7ee33595

SHA512
b10241d5016fc66f713eff6168c877aa3c4cb6dd9caaa3c9885b1f45165e3ec9f5101bbb3a283c9797e1d0e50f6d95d5d64303220b8387403403aa490e51cc55

Download Submit
C:\Users\Admin\AppData\Roaming\MrafPrDnarg\settings.dat

Filesize
112B

MD5
41499e69ec38c2a699eb9407a671fab0

SHA1
f25ac631d15c812e4924634cf291417ba7034a8b

SHA256
707bfde62cd20745b1f4a9840fa93fc9c929306a1b8397629fb58daea95b185f

SHA512
75c8f66294cd6cc0e5cbbb6ec18dc268aaa259ca7e3dfe0fddfc567364bc13f0c3bae8202b5d2d6e57870b805e62620fd37cf6d57be2b7f43029889ef925494c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 306812.crdownload

Filesize
458KB

MD5
098d8c5754874575ae835657ade15d31

SHA1
70297ea236b2b93e0abce660d505ebc99ace4b9e

SHA256
0b910636235397a68ea18c55310593ca82ab0becf1b6f4e3795c2ba501547318

SHA512
bcba3556ed7536a6141f1e4107b20a7cee6a6e41dc6d473f696f0cc844ea7448cbc86d80f7123c30394f8a5f1a68b52d371bdc03053fc13ccf654ed6f30a15e1

Download Submit
memory/5416-211-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-261-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-165-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-141-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-189-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-138-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-208-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-124-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-99-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-339-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-230-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-231-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-234-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-147-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-284-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-305-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5416-315-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/5928-77-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download
memory/5928-100-0x0000000140000000-0x000000014013B000-memory.dmp

Filesize
1.2MB

Download