zgrat | hxxps://github[.]com/GypsySynapse2/Calamari-SynapseZ/releases/

Analysis

max time kernel
199s
max time network
185s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13-08-2024 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/GypsySynapse2/Calamari-SynapseZ/releases/

Score

10^/10

zgrat discovery rat

Malware Config

Signatures

Detect ZGRat V2 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1284-355-0x0000000006640000-0x000000000671E000-memory.dmp	family_zgrat_v2

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Loads dropped DLL 1 IoCs

Processes:

Calamari.exe

pid process

1284 Calamari.exe

pid	process
1284	Calamari.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Calamari.exe

description	ioc	process
File opened (read-only)	\??\T:	Calamari.exe
File opened (read-only)	\??\Z:	Calamari.exe
File opened (read-only)	\??\B:	Calamari.exe
File opened (read-only)	\??\H:	Calamari.exe
File opened (read-only)	\??\K:	Calamari.exe
File opened (read-only)	\??\P:	Calamari.exe
File opened (read-only)	\??\Q:	Calamari.exe
File opened (read-only)	\??\S:	Calamari.exe
File opened (read-only)	\??\G:	Calamari.exe
File opened (read-only)	\??\I:	Calamari.exe
File opened (read-only)	\??\R:	Calamari.exe
File opened (read-only)	\??\X:	Calamari.exe
File opened (read-only)	\??\M:	Calamari.exe
File opened (read-only)	\??\O:	Calamari.exe
File opened (read-only)	\??\J:	Calamari.exe
File opened (read-only)	\??\L:	Calamari.exe
File opened (read-only)	\??\N:	Calamari.exe
File opened (read-only)	\??\U:	Calamari.exe
File opened (read-only)	\??\V:	Calamari.exe
File opened (read-only)	\??\W:	Calamari.exe
File opened (read-only)	\??\A:	Calamari.exe
File opened (read-only)	\??\E:	Calamari.exe
File opened (read-only)	\??\Y:	Calamari.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Calamari.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Calamari.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calamari.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

Processes:

msedge.exeCalamari.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1287768749-810021449-2672985988-1000\{030F5398-579B-4D0B-848D-72BFA2A18DBF}	Calamari.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	Calamari.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Calamari.zip:Zone.Identifier msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Calamari.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
2368	msedge.exe
2368	msedge.exe
3104	msedge.exe
3104	msedge.exe
1576	identity_helper.exe
1576	identity_helper.exe
1244	msedge.exe
1244	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3104 msedge.exe
3104 msedge.exe
3104 msedge.exe
3104 msedge.exe
3104 msedge.exe
3104 msedge.exe
3104 msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

Calamari.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	1284	Calamari.exe
Token: SeCreatePagefilePrivilege	1284	Calamari.exe
Token: 33	3424	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3424	AUDIODG.EXE
Token: SeShutdownPrivilege	1284	Calamari.exe
Token: SeCreatePagefilePrivilege	1284	Calamari.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3104 wrote to memory of 1472	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1472	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 4460	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 2368	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 2368	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe
PID 3104 wrote to memory of 1108	3104	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/GypsySynapse2/Calamari-SynapseZ/releases/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcf0bc3cb8,0x7ffcf0bc3cc8,0x7ffcf0bc3cd8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,10144563502129637466,9267824017344603235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4232

C:\Users\Admin\Desktop\Calamari\Calamari.exe
"C:\Users\Admin\Desktop\Calamari\Calamari.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d30a5618854b9da7bcfc03aeb0a594c4

SHA1
7f37105d7e5b1ecb270726915956c2271116eab7

SHA256
3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

SHA512
efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
03a56f81ee69dd9727832df26709a1c9

SHA1
ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

SHA256
65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

SHA512
e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3432381e7fbfa200794ee2754f97cb37

SHA1
7dd2b792b2bc30375ed620d27f59ba4384f0b057

SHA256
132437d9933a1b3167f909c8e306bbd14f409466d3bb265236fcebf79f0272e2

SHA512
ba334ac119a199f41df6be98e8d099cfe3844a729372c8c5618554f30842e602845dfdcab45116e93b01fd6dca2a2942afcf6885a2eefc5a515a0952d8dc6da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
ff997c70b1eee82d85b8a660841281c9

SHA1
26cd27f0cf62de21d22369b051cf94acce31a639

SHA256
f1401e201ffee75f1d7f5ee4a7cd20de72e09c3159d876951ff5570a74fae971

SHA512
4021baa43fa902519445649b9ee7162fdd5c22d9af1017b6d038be84005296c170ad89faa4d9da0e24d0976f4b15d7818045c2e79fbad10d5002a2d5ced2bf3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d326f472b936f40128d500b78c98fcdd

SHA1
ad24722aebe5bfeed0958a1be5b1b67963b77558

SHA256
236c1b02be6141ac79937482f0dffee78c845ebdb20a771d8f736446fdbdad05

SHA512
a78826944fc33dc7a1af5c230dc24464a45591bbf9b0b76bd59af93666cb53c0a0e0e079c0ea373f69e87c79e5684ee9e3081566270dbc527eaf18b67cb4da9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea3024391ee17933a848c2a59146bd20

SHA1
7055c690e5de39a8cc97fc982990a5aca5b142a7

SHA256
1be90f53c25a54430457500386ed3c8d951f0d778a9dd368982cb909b185d051

SHA512
fbf94955bb161471559f78d3d1b28df480ec6b3dbe65e3fa839272e225544e97aa1e0edc0f9a35f79ac5e0a360a0958ce7570c75eddb51516ea72776ad8e1fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
58a59bd6347dacb23787d8edbf45ec5a

SHA1
17e71c328cc3813d9663b7c58db2f9c502ab7dde

SHA256
98cb3b15a924647fd721c3fc8d53b4306af567cccf05e1ebda31d7677a5982f8

SHA512
db3e63d7481ae2fcf4ecfc445def2258d3abc630450e0dcf5cb08d093fdd78123901ca9d58d44219c97bc789223d42d4b50b209a6c5836152b592fb4be92fed5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
132fe3dfd9b0d44718b81e25e25e1368

SHA1
65311fd51465fa444460c83b8b542d3edf1b0185

SHA256
135ae5b602785b4b708c3f0d3db0cccc666bca80a5843dd581490b3a0e774f0e

SHA512
2282db14bcb0fd35e8b958074c4136af53d9ed2e8c139edf917fa4c4b8b6c1db6f274127e41d5234f733b02f10dfbd6f9817be92f5c075a7793e98388e481289

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f201.TMP

Filesize
874B

MD5
dcb70489e7223575ec8b9fca731669b4

SHA1
afa4b8a59989c49f9e686773941f5ff6645e53ca

SHA256
5764eda21d852636d1085359e24ebb7f797e9846d0c64aff6fb827b9941dfe8a

SHA512
f7a25a9296ec32e190140bdf6b2712fd3de6904f6a36cdc2a3c1945cc0c347c77b8ac5a6833f7c7bd3cbad140d06d53fd61fecb8a37e9baf7419befd6b089765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f5bf5e6d5f162d1c36faa979a9a7b08

SHA1
2a7845a2491eb99bf3b3a5d7ab9115148c039dbc

SHA256
2bd1a2fa69c369d9727a4e1f9a1e3f3f0236076cc57920cb36a4bf9c84801952

SHA512
1415440d011307247bb30f9b90347e69f4316ca6aa85487340ea609432cda4c2b8af0d84d5cf789a52503926c27be38102466bb2c99c842370e6e6ea1a8c1f71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
21d376efb1dd8b9cf7af14248652bb5b

SHA1
3f196b5cffe86e65b1bba717896130b4edf07a18

SHA256
1a507c4e5079b2ce085188b11fc168f294eeac93b4aeca67348efa0f5be941a0

SHA512
bfa7fa8c3cd637e7ef2af8f04ad9827171265b6048aa94fed03e2527bdf7c751f13bf803c01d7479e90a2b1c8c65fcaf455a684a8f278596267e860b6c220425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
384KB

MD5
5c44e27b856db169635881ba67aaa0e8

SHA1
3f0d99399500f29c51d4a560d960b27710ad6f2d

SHA256
461f4f10b8436d6f697fda640aea96a572f0efbbad15a0cca4a6f147dea4891a

SHA512
c7b87d16fee058e95d76ec524e311a7034ce7d90faabe050d380bbffa8382b12bd198db987b652998b6ba1ac72c6deef9de83a44a7d5864a2fef551a8170982d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x86\SciLexer.dll

Filesize
943KB

MD5
2ff7acfa80647ee46cc3c0e446327108

SHA1
c994820d03af722c244b046d1ee0967f1b5bc478

SHA256
08f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d

SHA512
50a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd

Download Submit
C:\Users\Admin\Downloads\Calamari.zip

Filesize
5.8MB

MD5
5321acff16bbe68a2942c9c655f9e4fc

SHA1
56f82061cb7d044c89470c01e7805cb2365c0bb9

SHA256
e232359fdbaa1d46dcf56a5715a0ba4c700c93fb310f551a4a3afa912afdaed1

SHA512
affb725177d76f3f8f86660f690e0d87a1a52198594334600d5c8b4a1653d6af83caaa74998e1b6c8a0e0891395acd2286cd03ecea26ea7b94694eac35279910

Download Submit
C:\Users\Admin\Downloads\Calamari.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
\??\pipe\LOCAL\crashpad_3104_XPIDMAMVHSGUMTFM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1284-317-0x0000000000160000-0x000000000018C000-memory.dmp

Filesize
176KB

Download
memory/1284-320-0x0000000005A10000-0x0000000005A1A000-memory.dmp

Filesize
40KB

Download
memory/1284-331-0x000000000A5C0000-0x000000000A5D0000-memory.dmp

Filesize
64KB

Download
memory/1284-334-0x000000000A5C0000-0x000000000A5D0000-memory.dmp

Filesize
64KB

Download
memory/1284-332-0x000000000A5C0000-0x000000000A5D0000-memory.dmp

Filesize
64KB

Download
memory/1284-333-0x000000000A5C0000-0x000000000A5D0000-memory.dmp

Filesize
64KB

Download
memory/1284-336-0x000000000A5C0000-0x000000000A5D0000-memory.dmp

Filesize
64KB

Download
memory/1284-335-0x000000000A5C0000-0x000000000A5D0000-memory.dmp

Filesize
64KB

Download
memory/1284-319-0x0000000004B00000-0x0000000004B92000-memory.dmp

Filesize
584KB

Download
memory/1284-349-0x000000000BAB0000-0x000000000BAB8000-memory.dmp

Filesize
32KB

Download
memory/1284-350-0x000000000C530000-0x000000000C684000-memory.dmp

Filesize
1.3MB

Download
memory/1284-318-0x00000000050B0000-0x0000000005656000-memory.dmp

Filesize
5.6MB

Download
memory/1284-355-0x0000000006640000-0x000000000671E000-memory.dmp

Filesize
888KB

Download