Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/m...

windows10-ltsc 2021-x64

10

Resubmissions

22-12-2024 13:20

241222-qk7ljazjf1 10

22-12-2024 13:18

241222-qj4hgszndj 10

Analysis

  • max time kernel
    163s
  • max time network
    163s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    22-12-2024 13:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://github.com/moom825/xeno-rat/releases/tag/1.8.7

Score
10/10
xenoratdiscoveryrattrojan

Malware Config

Extracted

Family

xenorat

C2

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    appdata

  • port

    4444

  • startup_name

    schost

Signatures

  • Detect XenoRat Payload 2 IoCs
  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Xenorat family
    xenorat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 61 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 57 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/moom825/xeno-rat/releases/tag/1.8.7
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ff8042446f8,0x7ff804244708,0x7ff804244718
      2⤵
        PID:3384
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
        2⤵
          PID:324
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:548
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
          2⤵
            PID:2116
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
            2⤵
              PID:4736
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
              2⤵
                PID:3688
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
                2⤵
                  PID:4252
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                  2⤵
                  • Drops file in Program Files directory
                  PID:636
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6a51c5460,0x7ff6a51c5470,0x7ff6a51c5480
                    3⤵
                      PID:2208
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4568
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5952 /prefetch:8
                    2⤵
                      PID:804
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
                      2⤵
                        PID:1476
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4252
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
                        2⤵
                          PID:1128
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
                          2⤵
                            PID:2736
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
                            2⤵
                              PID:1412
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
                              2⤵
                                PID:1648
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14510270969313866997,9992778949050334177,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2892 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2916
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:3624
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2032
                                • C:\Windows\System32\rundll32.exe
                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                  1⤵
                                    PID:5968
                                  • C:\Users\Admin\Downloads\Release\xeno rat server.exe
                                    "C:\Users\Admin\Downloads\Release\xeno rat server.exe"
                                    1⤵
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2596
                                  • C:\Users\Admin\Pictures\file.exe
                                    "C:\Users\Admin\Pictures\file.exe"
                                    1⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:5788
                                    • C:\Users\Admin\AppData\Roaming\XenoManager\file.exe
                                      "C:\Users\Admin\AppData\Roaming\XenoManager\file.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:5920
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        "schtasks.exe" /Create /TN "schost" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC5CC.tmp" /F
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:6044
                                  • C:\Users\Admin\Pictures\file.exe
                                    "C:\Users\Admin\Pictures\file.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:1564
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      "schtasks.exe" /Create /TN "schost" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFC6C.tmp" /F
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:2692
                                  • C:\Users\Admin\Pictures\file.exe
                                    "C:\Users\Admin\Pictures\file.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:5868
                                  • C:\Users\Admin\Pictures\file.exe
                                    "C:\Users\Admin\Pictures\file.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:1812
                                  • C:\Users\Admin\Downloads\Release\xeno rat server.exe
                                    "C:\Users\Admin\Downloads\Release\xeno rat server.exe"
                                    1⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:5760
                                  • C:\Windows\system32\taskmgr.exe
                                    "C:\Windows\system32\taskmgr.exe" /4
                                    1⤵
                                    • Checks SCSI registry key(s)
                                    • Checks processor information in registry
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:4332

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
                                    Filesize

                                    226B

                                    MD5

                                    66aea5e724c4a224d092067c3381783b

                                    SHA1

                                    ee3cc64c4370a255391bdfeef2883d5b7a6e6230

                                    SHA256

                                    04b17cab961f973464bba8924f764edef6451d1774f2405d27ef33d164296923

                                    SHA512

                                    5d719e303f491d1443cb7c7e8946481e90532522a422c98f82466e1eddcd1ef24a4505dcbf75f2191fbb66825d3550566d7f408a3854edeb4c1a192c8c9a6d06

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                    Filesize

                                    152B

                                    MD5

                                    b03d78ec6b6f6bfc8ce2f6e81cd88647

                                    SHA1

                                    014cb7dc4aa1bc5d2cb4ec25ec58470baf5b6741

                                    SHA256

                                    983928a84fcf0791614cc3d17d92d62ffbed0bf0f141d7544d0cc762977a3905

                                    SHA512

                                    4699916bdfa5776d72ad2643fad072a7a19783900608290bd1246a19624d61b58a1d80eceb74215b7198aaf04c526fa8703d38f3c5fdcc1add19b87508685ce0

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                    Filesize

                                    152B

                                    MD5

                                    95ba0df0c4c417ae5a52c277e5f43b64

                                    SHA1

                                    7c3bf3447551678f742cc311cd4cf7b2a99ab3be

                                    SHA256

                                    fdaa82c65558793b81117a66acd5645d4072f6b71f164ed2717a17cab6e727ea

                                    SHA512

                                    fcb35a1949664f218ae40c25fd6eaefc4ba6417034a522f0800c50ee78e530c33080faa73ff9ea82f35749d404d6b9c94fc7e8e224689503e699a5ec2b0d5abb

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                    Filesize

                                    1KB

                                    MD5

                                    66fc7f573f9afb4fc9c69e8b52e10d51

                                    SHA1

                                    362384d3e9826de5c4952358c1dcd2ab81f48841

                                    SHA256

                                    ca15a230882ca6b2b1c53bb17e2d303c30de3ea9fb5392a90cfdc5fa34ffef8a

                                    SHA512

                                    20a1adfe8d8e28363ed7908319c7931241c6f80df73b4046a34cda4bfacdcde4e4d585520cf97c769428cab7002513e860c20e5a05f443063f8ad7c4d152a288

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                    Filesize

                                    48B

                                    MD5

                                    ef05b51ecc47d7e8b658d124caa9799d

                                    SHA1

                                    a2819b6005b9de085f8a689473d3fdedce960ff7

                                    SHA256

                                    76604cfddb340190e1dabdbc31ddd807531deaeea0a74775a666b76f7ddd1ec9

                                    SHA512

                                    3477b80a61e7248e0825e4c3c276b6afd2c82283e911899afc2d5ae71666d608010940ec51a772b58725874a0b627bebc42cc8a2036a4139c5b22e59105629bb

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                    Filesize

                                    70KB

                                    MD5

                                    e5e3377341056643b0494b6842c0b544

                                    SHA1

                                    d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                    SHA256

                                    e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                    SHA512

                                    83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                    Filesize

                                    496B

                                    MD5

                                    30322550d9f9c54f345ea1c71f3b2e8f

                                    SHA1

                                    b5a3cff2995147279c2bbed7c03b2280ecb286e5

                                    SHA256

                                    4e7798d8476361378f8fbfb0442db63c7f6bf7e1830d50808bfdb8a58700d8f9

                                    SHA512

                                    261d1f5bc9c8a369f815eb846c252f54681f70862153bd49959411450870207b3ee240cc9016533c27401922527d561cc1ea7bb23708e4a257f071d010cf55ef

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58b418.TMP
                                    Filesize

                                    59B

                                    MD5

                                    2800881c775077e1c4b6e06bf4676de4

                                    SHA1

                                    2873631068c8b3b9495638c865915be822442c8b

                                    SHA256

                                    226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                    SHA512

                                    e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    5KB

                                    MD5

                                    ea9344520ef243b42fe26580eabdcb48

                                    SHA1

                                    320c897a5710ff21777fdf464a30300e78d8553b

                                    SHA256

                                    5a32a07702b1236dce991e7e0986fba3246d894764c8afaeb955f1e8877c3c6a

                                    SHA512

                                    94ce5e799b7684aebeacf345f4309f15ad5c086a564d90f66a441cbbb60c046bfb935ac252e57049a46099e9f58a1234e3ba94d786b418a3758cc740b45bbcc1

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    5KB

                                    MD5

                                    75e6b29339bfa9d1395115632a5674b8

                                    SHA1

                                    85a3bfb9b8ee6acd88f94ce158af2b0ea7a24e58

                                    SHA256

                                    37a88eb9f30e9eceea3bdb7bd47f06fe2ed2ca36c687e5e9e54c85932cd9597e

                                    SHA512

                                    f51a2d11fc39e6eeebdffc7e466e0f75230987654dedc60958c6f4894b0a8f8b90f91dbb2fcccc93d5beab1197c7978cc255277c8569ca13522a358907a2331b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                    Filesize

                                    5KB

                                    MD5

                                    7c1b73fbd37e8e9ce795fc6899a4a73c

                                    SHA1

                                    0f7c041df37efe626051c19dea13295b02d8a4fd

                                    SHA256

                                    b3057d5bf376552e45517e1ba2beed599ff56cf3100c15554458acf542fc1f5a

                                    SHA512

                                    89810627ffbe86e5f78c4c26b22da0e07a1606d406b2790f1d481d3ce500dd0036599e1983d0a70691107e0880114125a6b683713211e1df8c288c4ce14f91c7

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                    Filesize

                                    24KB

                                    MD5

                                    0493f44576fd7d9b6216b7387a26543e

                                    SHA1

                                    47d35c7f2990ec4668ecf1c01e0e5f623153a3f3

                                    SHA256

                                    0679b6900e2118e17164159f449fdc1f6bf20c0cc0b056cc9aedfae42a830ca8

                                    SHA512

                                    a519962ffb281d471bcf63c0bf75bed19d4eeac591cf6bf8565af14dde1d57fe8cabfc05bec52b2087ce8c6f637dbefb438ce22054895dc116b31bffa18e9cd3

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                    Filesize

                                    24KB

                                    MD5

                                    1cc3bc2b1c52831cc0b972d856888e8c

                                    SHA1

                                    9ffa8cf55aa29f6cbdd5ec39b1b33938b29e9990

                                    SHA256

                                    a8f894b23c518e04d94f1bb51343443de8121366171d2f05441283dbb1cfdd2c

                                    SHA512

                                    85bd6789da57c911f9cc35929ab302829614a4f03b3de30e28ab16558279ed02200a7db802c9bcd6b2e5886ea3c323d6a39eb8c3ee309d8b5702be65dab7c3dd

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                    Filesize

                                    874B

                                    MD5

                                    403ec7e0239bc46d33167b2780679d5f

                                    SHA1

                                    427b01833db453e13e731290bd89e5f0237f1b4d

                                    SHA256

                                    7d46cfd1b8d94a23775b61e9ea31e58cae05ebd403ad8f5cab0b0276244e9aba

                                    SHA512

                                    600a0d98ae8c52082eadd48d524ff05406fe11f0cf49fee9b60963378e3055e2de47a8edf13bc9be1ef64c9134ec4ce225c8aae734e45ccc910e1c8494241a14

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                    Filesize

                                    874B

                                    MD5

                                    676fdecc6e2ac6299e9bac24fdf82e29

                                    SHA1

                                    42dc310b1e53a3eaa47c7f60adabd277f8b8ee37

                                    SHA256

                                    280e9feef00fb32d9cc4e105e8d82411d70312f26407b296b02037f61ab0187e

                                    SHA512

                                    2280dbed2ee8892cafbfdfa3b84e83aa2cb1018b5d93edab30db9512a3fa9631f28a2c9fd77db062665ce1da76a7121c9c456a72d5595aaea991d692a43dfdf5

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f6c4.TMP
                                    Filesize

                                    874B

                                    MD5

                                    b236de4aab3ece6166a9e24b5e16deca

                                    SHA1

                                    35c702adf5c42764b10f99830d148b9a7f99dbaf

                                    SHA256

                                    805dab56399b42ca3b3d96aad994dba51752a7fb7355ae36927200cfb7afdaff

                                    SHA512

                                    e9b92964f666a669a074f776f5e1fc2d7cedd1c44649be251b20db80bc6251a93ee784fa3ca4dc98288fbf925eedb2af5493ef4ad6f7534695ff772c91edd7ce

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                    Filesize

                                    16B

                                    MD5

                                    206702161f94c5cd39fadd03f4014d98

                                    SHA1

                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                    SHA256

                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                    SHA512

                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
                                    Filesize

                                    41B

                                    MD5

                                    5af87dfd673ba2115e2fcf5cfdb727ab

                                    SHA1

                                    d5b5bbf396dc291274584ef71f444f420b6056f1

                                    SHA256

                                    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                    SHA512

                                    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
                                    Filesize

                                    16B

                                    MD5

                                    46295cac801e5d4857d09837238a6394

                                    SHA1

                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                    SHA256

                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                    SHA512

                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                    Filesize

                                    10KB

                                    MD5

                                    501508534167a34e11f1f678ad18db79

                                    SHA1

                                    a5b77f70739cbaf537890c214151ce37dffa05a5

                                    SHA256

                                    d34768fadd5b29a06d4066761f5ed5c0ad9a76ab5820ff9e7675d2999aa1b61a

                                    SHA512

                                    5fe6b621ca5f2af8c5af75d3c4237f3a2966a548f0c023fa0dc28013694aac8cc611e867e3364b16486b0c26bb68d2e8c45605415e8f15d078661bfd12d21faf

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                    Filesize

                                    8KB

                                    MD5

                                    257f019f0c6606e10b5f49e367531eab

                                    SHA1

                                    30e6face7474b2a2283c6feb1b2932ee58d052d6

                                    SHA256

                                    6646d64c704d55c9c4d977096460c03f58e5443cf5f2bb1e068563a09353eb33

                                    SHA512

                                    5840fe808f066ffc5e38fd91ba7f84db0f75d01d25914d17c35e6c146e2c66e020962c3bcf6fb2dea8f691ffe857e665462cc19a2198248484212476b0996120

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\tmpC5CC.tmp
                                    Filesize

                                    1KB

                                    MD5

                                    a0397d62ca78dab38f367f379dfdcbe0

                                    SHA1

                                    a46bb7d79e431417dc1e99aa848936466d312265

                                    SHA256

                                    0f51d63f93a16fed389f22873e347022a1e92c7728d5c4a56cf862aeb6675850

                                    SHA512

                                    27db3fe96fe1c1d56ed68706a6d0a1c42cb596fb6a91f367667498d7c5806cac407e8ff97e55aa7840b2da6148ff8cd4aa1bedf7b05aee62bce3084d342d97a1

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\tmpFC6C.tmp
                                    Filesize

                                    1KB

                                    MD5

                                    ed753d39ef86e7957d6be6206ca2ce4a

                                    SHA1

                                    f663e8555180aed96dd595fa0ed8523e581bac08

                                    SHA256

                                    e6b5b43ffa8d034cd5ce5d007187b0d227719bb31e3af771c4ed8844a05027b3

                                    SHA512

                                    a9a85dde14fbeaa5f3e04f3e4e1107a31f8ef9eb99e29e6a2157e614058eb8f205d9843a62e8fbbc6e7143a256295149d817f3ca72762f3ce193bcb3e66680e4

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                    Filesize

                                    3KB

                                    MD5

                                    a16a4f26f79a982fe06ae33d45a8d5ee

                                    SHA1

                                    a5b086221f4a6f69509ae55d46da98b25febbb54

                                    SHA256

                                    491ea9061fac5329798231139494ab364270929e0e39c96ac81e95b42cf3e08d

                                    SHA512

                                    a890bf96fa0cbbf0d2ae91cba1cfea125f8c9f13306faca25b01edb50496d6518c042663d5824637b3c7c2b2b5f30dd9af598d065ad066903801eed95bf73a19

                                    Download Submit

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                    Filesize

                                    3KB

                                    MD5

                                    3018be67004d42a6d8d0dac650d33281

                                    SHA1

                                    16f6d00f86ef5602d3774dd03200e0da9255ef0c

                                    SHA256

                                    7bf4f000ea097450358fa93d0644e4ae04fe32b4dddde45e4956b18033925aa5

                                    SHA512

                                    72f24c8db7c3617d9ed64eb8308d1c6a2b2b66824e2b563593bfb4262ce98f2cc6f68fccbb4d1d70c5a2cb16bfd3e5ce14a984c8579d5d6a7d2ade4f3126862a

                                    Download Submit

                                  • C:\Users\Admin\Downloads\Release\Config.json
                                    Filesize

                                    466B

                                    MD5

                                    8ca01064af13ef2de24e3c2e1dceaccd

                                    SHA1

                                    aa49320fad4e108ec1b3ec4505e7437cac476bae

                                    SHA256

                                    9c8e47df0a42435da537384c3f86e14b73ac849f6fc354d6be9c0f8d26d9579b

                                    SHA512

                                    cc46484bb6674e77d4db5102f19d6591870a4dc8b51c07d7b82ed3d808c6c83bca6afd4b8c9cb149af948097fa469a2564fb3c16ea7a726ec7eb0282bfb6c5b1

                                    Download Submit

                                  • C:\Users\Admin\Downloads\Unconfirmed 669075.crdownload
                                    Filesize

                                    6.4MB

                                    MD5

                                    89661a9ff6de529497fec56a112bf75e

                                    SHA1

                                    2dd31a19489f4d7c562b647f69117e31b894b5c3

                                    SHA256

                                    e7b275d70655db9cb43fa606bbe2e4f22478ca4962bbf9f299d66eda567d63cd

                                    SHA512

                                    33c765bf85fbec0e58924ece948b80a7d73b7577557eaac8865e481c61ad6b71f8b5b846026103239b3bd21f438ff0d7c1430a51a4a149f16a215faad6dab68f

                                    Download Submit

                                  • C:\Users\Admin\Pictures\file.exe
                                    Filesize

                                    45KB

                                    MD5

                                    6e7d0ab482486b2386e8061ef14b6863

                                    SHA1

                                    356c91ece158300f1dc4ff03f95e872b6e30c668

                                    SHA256

                                    5ad7c2999e7fccec5b707d713441a9da6711a3e1f22dc39151fe231c649a2599

                                    SHA512

                                    6ea561b763e6482b4e685ced363149444f253066dbe50b993fce727230773c49c768ce1a4477ef79603683b895e76a124ac9eb1236e020de62c233d063e19e18

                                    Download Submit

                                  • memory/2596-343-0x00000000096B0000-0x0000000009762000-memory.dmp

                                    Filesize

                                    712KB

                                    Download

                                  • memory/2596-335-0x0000000005090000-0x0000000005122000-memory.dmp

                                    Filesize

                                    584KB

                                    Download

                                  • memory/2596-333-0x00000000004A0000-0x00000000006A2000-memory.dmp

                                    Filesize

                                    2.0MB

                                    Download

                                  • memory/2596-365-0x0000000006CF0000-0x0000000006E14000-memory.dmp

                                    Filesize

                                    1.1MB

                                    Download

                                  • memory/2596-366-0x0000000006E40000-0x0000000006E5A000-memory.dmp

                                    Filesize

                                    104KB

                                    Download

                                  • memory/2596-334-0x0000000005730000-0x0000000005CD6000-memory.dmp

                                    Filesize

                                    5.6MB

                                    Download

                                  • memory/2596-344-0x000000000A6E0000-0x000000000AA37000-memory.dmp

                                    Filesize

                                    3.3MB

                                    Download

                                  • memory/2596-340-0x000000000A4E0000-0x000000000A502000-memory.dmp

                                    Filesize

                                    136KB

                                    Download

                                  • memory/2596-339-0x00000000085E0000-0x00000000085F2000-memory.dmp

                                    Filesize

                                    72KB

                                    Download

                                  • memory/2596-338-0x00000000085C0000-0x00000000085DA000-memory.dmp

                                    Filesize

                                    104KB

                                    Download

                                  • memory/2596-337-0x0000000005710000-0x0000000005724000-memory.dmp

                                    Filesize

                                    80KB

                                    Download

                                  • memory/2596-336-0x0000000005150000-0x000000000515A000-memory.dmp

                                    Filesize

                                    40KB

                                    Download

                                  • memory/4332-438-0x0000017B29170000-0x0000017B29171000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4332-440-0x0000017B29170000-0x0000017B29171000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4332-439-0x0000017B29170000-0x0000017B29171000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4332-450-0x0000017B29170000-0x0000017B29171000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4332-449-0x0000017B29170000-0x0000017B29171000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4332-448-0x0000017B29170000-0x0000017B29171000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4332-447-0x0000017B29170000-0x0000017B29171000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4332-446-0x0000017B29170000-0x0000017B29171000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4332-445-0x0000017B29170000-0x0000017B29171000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4332-444-0x0000017B29170000-0x0000017B29171000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/5760-434-0x0000000008AD0000-0x0000000008E27000-memory.dmp

                                    Filesize

                                    3.3MB

                                    Download

                                  • memory/5788-396-0x0000000000D20000-0x0000000000D32000-memory.dmp

                                    Filesize

                                    72KB

                                    Download