xenorat | hxxps://gofile[.]io/d/Fz9DPF

Analysis

max time kernel
261s
max time network
263s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
30-01-2025 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/Fz9DPF

Score

10^/10

xenorat defense_evasion discovery rat trojan

Malware Config

Extracted

Family

xenorat

127.0.0.1

Mutex

Xeno_rat_nd8912d

Attributes

delay
5000
install_path
nothingset
port
5347
startup_name
hawktuah

Signatures

Detect XenoRat Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001400000002aba3-80.dat	family_xenorat
behavioral1/memory/3736-175-0x0000000000A20000-0x0000000000A32000-memory.dmp	family_xenorat

XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Xenorat family
xenorat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
22	1256	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
3736	test.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\test.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 913723.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\test.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1388	msedge.exe
1388	msedge.exe
1136	msedge.exe
1136	msedge.exe
2704	identity_helper.exe
2704	identity_helper.exe
2504	msedge.exe
2504	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 3104	1388	msedge.exe	77
PID 1388 wrote to memory of 3104	1388	msedge.exe	77
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1616	1388	msedge.exe	78
PID 1388 wrote to memory of 1256	1388	msedge.exe	79
PID 1388 wrote to memory of 1256	1388	msedge.exe	79
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80
PID 1388 wrote to memory of 4824	1388	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/Fz9DPF
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb92293cb8,0x7ffb92293cc8,0x7ffb92293cd8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Users\Admin\Downloads\test.exe
  "C:\Users\Admin\Downloads\test.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3736
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Create /TN "hawktuah" /XML "C:\Users\Admin\AppData\Local\Temp\tmp143A.tmp" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,15541902679171397727,1412566543404314816,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
672a379da6b355b3ddad33334643cc1f

SHA1
93df5334b4771065e230ea0288d20bd2c5329e73

SHA256
5d156ea4d917ba52f5307434e90cf2b21ae6a9759b36867e26cd882beb3276c8

SHA512
6c03883487e8e3b74a89cdba58be6632eb0049a8ea3fc2def0282a65323a4ebc2a9065b29d4ee0b8116f5627754908ad5a350bbd5429947e2962be75cb1fb2c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
399B

MD5
0342de65b42135820b04ecc386d0a704

SHA1
da7f520e783b5453dff8dc81fc322a4a229c920c

SHA256
d6031d5d7a61d3bfc3caa58582387424434447fef507b7b3e83f07e0e6587733

SHA512
1b3d4bca5e74b79b9fe7e382d89c1900b73fe3240e62d4abb08a97354addabb211aa2fbba213953144971aa7415960c7840bddadc0dffe7bc9a5ddb0fca2fd66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1911f35afc3b22ec802f7f3a026e0489

SHA1
952b1ac945ef0b90abb1236283d3e6378b0ed31f

SHA256
4f8eafdaed9571543aee71f442799ff773b196e389282431ed7af90c7463e36b

SHA512
b9aa5e18beeac1ead4b6a85b74fa291a7783f8e98f6a447a18555ac562e8777736fcb4d075edb18d656fa5994714791c5c7a9399a31a9264ec9fa4f7e62c022f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e20946ec1cf65e1ef7909d33545bfcd

SHA1
c5dce6834bf282dec514cf1bb45a402b905ec747

SHA256
6d3f65f9b3d7a7d34050611e3449b5e96e57de9f124966c5311ab71643f3d685

SHA512
7d9be6ebe1a120767a973852f53a902413da3bf96203c5268052be26102dab29bfea4f4169fba466b470ec6028a7e1006c4e4e6cb60a42310b65848f8619620d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b8a64c1014c522e0809c18161079c629

SHA1
45e482a71dcb837ce1b27a8e783b84b47324d1ea

SHA256
135f0f8159c5f973342f63a59d595437c39fc4e3e43aa47d4c2fd68c87164970

SHA512
fef621220b440a3b84984903f1ea745a96bbe43716f3c7a5ded42b4c870837e5e619c70efcd07ed8fc83d9fe342bbee8edb5cb07112e23134ef6f6bd8fe90edc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e30c575daa231282389fd811905bbb01

SHA1
c5fe020efeb5cb737cf410ad5a62fa67e600fa92

SHA256
ebf27ff069b6d4a9f5d1b1fdc62dc9d8661d81d70a7bba0df0367e9284ef7341

SHA512
54ce7d9bae3421e1d74a56f4fde291e7db7353f4d6e061b887c414fb1078df74cfd4889e29038b033452de84da38260fa2e7578ccdca307a694fc69d11d57a23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
49743e08ee474ec0c8cf93a9a8898ba9

SHA1
eb7824f7df6a2a16ee3f78a3862758c5e2c906b6

SHA256
240b7a68c3c9888857fcdeabf55b9995463aa7cbc86c576e4cc139176355fcb1

SHA512
27a0230c3fa66c09d67cf47175ba568038c32d293fc8970b45032a26aa7e263deb40e85a8272e433a34f9e89816b2c4f1531ce9798ccb528822b18fe2c04c539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
46e0ed590453088d23981867a4d58a3d

SHA1
8e46f8ead70889d1113289d2872442c7908e98ba

SHA256
b4832b404da717a25943ce49e8562bb8f8a753e6aa5fc66d0cbb7d89972594c8

SHA512
d2cb69567732bae852187137a9787f1c8c318e070d9f6b1916567ece1ae4a86d35d3dc69fab7d40b57e6010a580aee20af9a76a168975fc0ab2c6f4c475bd78c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ddc8eaa0b317d66c0d7774a592dc1bb0

SHA1
834eed5b62102b2bcec6cd582d254f1a6d701ebe

SHA256
952cb73344ffe3d993c7b0dbdcd74677e6772595c747a49d14d3448f2f935c4d

SHA512
4da8e733548b5fb86563369e9b0f43ccd4fda0bd25e6c7f6e1d493c085f0e1098f8d74968a5d4267b67b1e8ccf698cefa02382be80f920bd956a291416285624

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp143A.tmp

Filesize
1KB

MD5
19b126871d3609592cd5ead895a8079b

SHA1
4013bb2c8c7c692ba68887b4a97343feb8b16414

SHA256
399279f5a6bc1a301af0ed8372b839af9b56b1f99ace028b9b25bbf18ae1a35a

SHA512
8ecdfdb6b0a5b323b68310c9d4cfa5d112c76233057195f8e16cf1d9705d1d6972e4ba95232fafd44a59fe839f9ef35ff947b1ee83192209017ce3ebaabe8823

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 913723.crdownload

Filesize
45KB

MD5
7c1acf105334aab29f9d0c740773ef59

SHA1
538b0d52458886f137d40109d643b939886b37c8

SHA256
e6388086235afc03f4a407af11d242627f39473d04c09ecd604bb8d701983f6e

SHA512
7f6e1d54334b668770dae75e6dedddf9447336a9bbbd350b02a915c17e96a8edda0372fef44d7fe461054259c02e30d5fbc519afdb29cda840d9b1853d92e9b5

Download Submit
C:\Users\Admin\Downloads\test.exe:Zone.Identifier

Filesize
159B

MD5
fb2b387df278496c5ddfc6481706d246

SHA1
fce7b3da987af1c85739a657ffeb310bffe36886

SHA256
f20be3dfb790534a6a7755ba8072a08950e1dd714235d54ca5c406af5525147d

SHA512
bcaf15dcc975fd17603a332166469d98b2915672454ea773cf54e162f2be5d82321844bd11dc61032b13bbd23f95c152c5c658e7c610a21df308deffc7261b3c

Download Submit
memory/3736-175-0x0000000000A20000-0x0000000000A32000-memory.dmp

Filesize
72KB

Download