darkcomet | hxxps://dosya[.]co/0i10r4gk9w0o/qsdfj[.]zip[.]html

Analysis

max time kernel
84s
max time network
79s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
15-12-2024 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dosya.co/0i10r4gk9w0o/qsdfj.zip.html

Score

10^/10

darkcomet discovery phishing rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
A potential corporate email address has been identified in the URL: [email protected]
phishing

Executes dropped EXE 2 IoCs

pid	Process
1516	upnp.exe
228	upnp.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001400000002acde-185.dat	upx
behavioral1/memory/1516-188-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/1516-202-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/228-220-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DarkComet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnp.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\qsdfj.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1656	msedge.exe
1656	msedge.exe
2104	msedge.exe
2104	msedge.exe
3680	identity_helper.exe
3680	identity_helper.exe
3140	msedge.exe
3140	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3364	DarkComet.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
3364	DarkComet.exe
3364	DarkComet.exe
3364	DarkComet.exe
3364	DarkComet.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3364	DarkComet.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1196	1656	msedge.exe	77
PID 1656 wrote to memory of 1196	1656	msedge.exe	77
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1644	1656	msedge.exe	78
PID 1656 wrote to memory of 1060	1656	msedge.exe	79
PID 1656 wrote to memory of 1060	1656	msedge.exe	79
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80
PID 1656 wrote to memory of 4784	1656	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://dosya.co/0i10r4gk9w0o/qsdfj.zip.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff895623cb8,0x7ff895623cc8,0x7ff895623cd8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,12883741292293514270,1463703813849374845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3016 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4956

C:\Users\Admin\Desktop\DARKCOMET 5.3.1\DarkComet.exe
"C:\Users\Admin\Desktop\DARKCOMET 5.3.1\DarkComet.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3364
- C:\Users\Admin\AppData\Local\Temp\upnp.exe
  "C:\Users\Admin\AppData\Local\Temp\upnp.exe" -a 10.127.0.32 1604 1604 TCP
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\upnp.exe
  "C:\Users\Admin\AppData\Local\Temp\upnp.exe" -a 10.127.0.32 1604 1604 TCP
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
59f007416f7ee5da3017017360ff4c0c

SHA1
d9fa429f80ee10b76422335e62fa7e2e3fadc7e2

SHA256
d23841724082d8d333ce0f807c2878ce8b2f25e59094b1faf486b7b527d1d74a

SHA512
abfd282732615eff19223c64016561909257f0a0b162c5d799c9e90c52bfd4a77de6f78eea0f0a5d16bcab631b76ec6e511b949825bcc6f466d74f022e7273f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6c0e9a891c289c0f0bc7de9646aa210b

SHA1
193cb0a7361f8974c1f4fa2a4ec00697b23c55ed

SHA256
0ddfbcaa5be02322410bdbcad0a2e6e2413b5a9a4fc298e7ebee40ff552abcfb

SHA512
1a9311da864f99e968282c7c5d1fa1b031cb081678c32a2483a7e2bff6033c437edf552a42aef007a02088192b900344b66ef711068542a38b498f79fefb5138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a76523284a810242cdc41e9bcdc8c68

SHA1
fc27775e6f032e4d4a0df50f7533ea80294a7043

SHA256
410bcbff6f308428473766aa106f44b0486fb9b63491a1492e5495a7d6e18775

SHA512
c1ec400a1ace5616e9d040994d35d30b7313e6784d57aa47d3333a050fef5a5cc8843b8960e3bc0694f136448c596a18ad48a10d9e970b73f1defb63d8ea5cd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73e6593fec0a42accb578fceedfa2306

SHA1
2ebb5785270be299f76a3edf67bc83e97927ed9a

SHA256
0c805880d43d7b740c6da80447e35bea480d009e6f4b5c1bc0565d9712884568

SHA512
998bce457948d6db541c8b34c018a324dba0976f787133639762ea10b0491f60f7bc85fba4add8df13cdc48cd2fe84b357d3698e91c81a3cc1c3be92c9aa2161

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d15cc6624e999e604f9138518ef4672

SHA1
3a438b3e6fd998296309dd6a9a55449633344679

SHA256
daa7983519aeb15edc4bf3f7bb085b9565843d5a6fc45f5443b714ae2c666171

SHA512
4d9fb429b68fa850bef7ed4dd42136fb1f3cfccd16d40559b5000d063cfcf8c47d053c355299adc46ca034cea49c39e7d637c162490c49aac5d5a3c9c6f9fa17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57da3d78abe6014a7ebce21e30abddd9

SHA1
83e1fa56aefeecf7d5d4d3eee3fcb71caf9a8345

SHA256
acb1ecf7ccce614fa43f98cfe3f23ad5f2cf6389c49fe2b4c0d6d14854ec8750

SHA512
e0e9f915165a5aaedd486e1c6ec454cbef5898dee4e8c815359385135774e60aca5ef103471b021fe920d4566e27e13c3386b13978deb945f69af462f9b78d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1aff38dc8da4de94a15be88fd6c2a832

SHA1
25771ae440cce2a8f226f5ba960d5cdfc66a43b2

SHA256
526175b086ff79f4d4bde88f63fa17dd22dd22e8eff8d8d86c3522052935de62

SHA512
c558e6cb10c1c9de96e101b09bc9a3b3ffd2301b261575b1e4cb5cb8e935cb9977f55337b341d05c4a34890458ff701cb4e9b7eb85214b7c3c0b8447dd764f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
79f7764d5ecb19c2999dcfe8c90b4167

SHA1
1605469934a19c45df72eaf4c67658c7d38fd9fc

SHA256
7dfba1ad8d559915d991d8ce36ede930bcce2112992eb26f881a157407d112a8

SHA512
2de11d6acd5b06fbe6ac6852b5b2c34e202053f6f5c3732f2797396d0f497962f6139d49540f23f51f011c11d63cfd941a0d83be2321e3349ffa85c49b2267f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\upnp.exe

Filesize
12KB

MD5
13804f8dc4e72ba103d5e34de895c9db

SHA1
03d7a0500ccb2fef3222ed1eb55f2cbedbb8b8c5

SHA256
da659d8c05cfcb5f0abe167191665359123643000d12140836c28d204294ceb6

SHA512
9abb98795a1b1c142c50c7c110966b4249972de5b1f40445b27d70c3127140b0ddaaada1d92297e96ffd71177b12cd87749953ffdcf6e5da7803b9f9527d7652

Download Submit
C:\Users\Admin\Desktop\DARKCOMET 5.3.1\config.ini

Filesize
5KB

MD5
bf10acfdebc5e725ea7f9750948976a9

SHA1
b88d8d43c323d0b9f5b913f9e62b74bfaa027803

SHA256
9d38fe5d246e6520983b053435ea938337059c12c8ffebe56883a51a31ac2165

SHA512
fd166e49cd6bb522e5326c6baa0557c08721cdee2a18cc9d66be1ee91496813088149755256a23666b24bd5d0839b7b71b4e359a4a187c375e389a1882c8ab9e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 253996.crdownload

Filesize
14.9MB

MD5
35e07beb79589af0d9c6a8b29771d4fb

SHA1
3001b290979d01095f8cb19c47ecc4090b070536

SHA256
1d330b5ce0e900ad5351930331a8740006df6e4bf2cdf69f78a3e7ad9f692f47

SHA512
125268c7cd80528401acd28c0e34b7d49a961ec23f4aebd5b82376005215426b1d545ff222192ca8bad08c6aa9e6c9e3ed0d476147c6bab6d5e232638543be30

Download Submit
C:\Users\Admin\Downloads\qsdfj.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/228-220-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1516-188-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1516-202-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3364-203-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/3364-221-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download
memory/3364-274-0x0000000000400000-0x0000000000F67000-memory.dmp

Filesize
11.4MB

Download