xred | hxxps://github[.]com/Haxhom/malware-leaks/blob/main/

Resubmissions

23/02/2025, 15:45

250223-s64g4s1rat 8

23/02/2025, 15:39

250223-s3q3ls1qct 10

23/02/2025, 15:36

250223-s147fs1qav 8

23/02/2025, 15:32

250223-synfxssmfn 10

Analysis

max time kernel
209s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2025, 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Haxhom/malware-leaks/blob/main/

Score

10^/10

xred backdoor bootkit discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 544 created 5068	544	taskmgr.exe	112
PID 544 created 5068	544	taskmgr.exe	112

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Downloads MZ/PE file 4 IoCs

flow	pid	Process
54	4424	msedge.exe
54	4424	msedge.exe
54	4424	msedge.exe
54	4424	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	Blueman.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 7 IoCs

pid	Process
3660	Blueman.exe
2280	._cache_Blueman.exe
1340	Synaptics.exe
5068	._cache_Synaptics.exe
3968	solaris (1).exe
5308	Kolesium.exe
5908	venus.exe

Loads dropped DLL 2 IoCs

pid	Process
1340	Synaptics.exe
1340	Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	Blueman.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
53	raw.githubusercontent.com
54	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	venus.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3488	5068	WerFault.exe	112
2972	5068	WerFault.exe	112

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Blueman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	solaris (1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kolesium.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	venus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blueman.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Blueman.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

NTFS ADS 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 56847.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 121724.crdownload:SmartScreen	msedge.exe
File created	C:\ProgramData\Synaptics\Synaptics.exe\:SmartScreen:$DATA	Blueman.exe
File created	C:\Users\Admin\Documents\~$cache1\:SmartScreen:$DATA	Synaptics.exe
File created	C:\Users\Admin\Desktop\~$cache1\:SmartScreen:$DATA	Synaptics.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 193866.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 544411.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 672568.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1876	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
3468	msedge.exe
3468	msedge.exe
1704	identity_helper.exe
1704	identity_helper.exe
2880	msedge.exe
2880	msedge.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
2360	msedge.exe
2360	msedge.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe
4948	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	taskmgr.exe
Token: SeSystemProfilePrivilege	544	taskmgr.exe
Token: SeCreateGlobalPrivilege	544	taskmgr.exe
Token: SeDebugPrivilege	4948	taskmgr.exe
Token: SeSystemProfilePrivilege	4948	taskmgr.exe
Token: SeCreateGlobalPrivilege	4948	taskmgr.exe
Token: 33	2812	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2812	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
544	taskmgr.exe
4948	taskmgr.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1876	EXCEL.EXE
1876	EXCEL.EXE
1876	EXCEL.EXE
1876	EXCEL.EXE
1876	EXCEL.EXE
1876	EXCEL.EXE
1876	EXCEL.EXE
1876	EXCEL.EXE
5908	venus.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 2516	3468	msedge.exe	87
PID 3468 wrote to memory of 2516	3468	msedge.exe	87
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 1532	3468	msedge.exe	89
PID 3468 wrote to memory of 4424	3468	msedge.exe	90
PID 3468 wrote to memory of 4424	3468	msedge.exe	90
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91
PID 3468 wrote to memory of 2876	3468	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Haxhom/malware-leaks/blob/main/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3e7646f8,0x7ffb3e764708,0x7ffb3e764718
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Users\Admin\Downloads\Blueman.exe
  "C:\Users\Admin\Downloads\Blueman.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - NTFS ADS
  PID:3660
- - C:\Users\Admin\Downloads\._cache_Blueman.exe
    "C:\Users\Admin\Downloads\._cache_Blueman.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2280
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - NTFS ADS
    PID:1340
  - - C:\Users\Admin\Downloads\._cache_Synaptics.exe
      "C:\Users\Admin\Downloads\._cache_Synaptics.exe" InjUpdate
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5068
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 1328
        5⤵
        Program crash
        
        PID:3488
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 1352
        5⤵
        Program crash
        
        PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2904 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:4520
- C:\Users\Admin\Downloads\solaris (1).exe
  "C:\Users\Admin\Downloads\solaris (1).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=dQw4w9WgXcQ
    3⤵
    PID:532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb3e7646f8,0x7ffb3e764708,0x7ffb3e764718
      4⤵
      PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,5878812652145965799,12319836748382277502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:5796
- C:\Users\Admin\Downloads\venus.exe
  "C:\Users\Admin\Downloads\venus.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2652

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1876

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5068 -ip 5068
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5068 -ip 5068
1⤵
PID:884

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3432

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4d8 0x38c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3796

C:\Users\Admin\Downloads\Kolesium.exe
"C:\Users\Admin\Downloads\Kolesium.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
43e0aff172309a232318dbde7fa3fcc6

SHA1
99a43de9bb9b7adc353f125e7bff16237838fdb9

SHA256
9bbf26529f9888ffad074952bbde0504404e70c9572a04b452d021e6fb27e4cf

SHA512
096c442b581fc7e6581e23cb50cbf64ee9b08e5dd6db4047a8bdfa36cbf3aeab8fe7360d9c8d2ce36c12404c41057dd82861dd4a8dada29530ab754d879df260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_2BB941531B2B417CB9B9143D82A69960

Filesize
472B

MD5
d1ab9b9f7af8e2cade53a02f58349cb7

SHA1
efa265f4f055d3835564d5a36733a8cbcb1600ce

SHA256
1e35c44060030f053665f1c900865bfebefae0672b17399e6242991d496fb81d

SHA512
0a9c965eb4638e2d31ba83130b0dd9cf2ea1f0325f5d3df704f60b243a7fa28da39341a516ec8164c9c21854a10a1ba3090f7ce50eaf4c2dea2a65cd14812bea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
170B

MD5
ac58e26a17ee306196ff61ba1d0df3c9

SHA1
a5d2f677fc9bceb8c88adba80772475bc95c6d30

SHA256
92fe36a4b418228f3a55d5386c5a3feba530ce94ee74aa22edb8b99deaa515f9

SHA512
7850c4511e5e8a0d9e7084e5a3e9f0ce019cceb49cb66698f46d5a185f995ce4ba361349bca620e390ae4902fcb840aa0133de47855a6a7aa8018fec653daae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
35d6eb14e4638c6f6437c8e552d610fa

SHA1
818bc1d0bfc256d689c804535945c0a7da6d0207

SHA256
5b55e72429cd5b88fe8fcf6038cdabbf75d13c7ac293d51d8ad1bca1e99a3e54

SHA512
12f5281477d136515a0503914b7a682ac4b1914d6cc3e577e1d4b27b06bccd02884fcce95bdf288e7587d1b65ea87c154ba7684262ac5ec48514e9c9dcc27812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_2BB941531B2B417CB9B9143D82A69960

Filesize
402B

MD5
4c709d86b1258fbfad8c34fe38328b43

SHA1
2fea253bc786a9ab5adafb71b6a481ef44783145

SHA256
5e096a45fbf5fe14e7c6d5f7d75d55196a378a3327d1dc76f5d8292bbfb70820

SHA512
cafe204f5da32d0b2fcbfba7aad93b5865dcd6712bb0603b13be7893d1f207a743132819b979a1a44fa058a6bf7aaa115a8dd4c0029128ce3e625cd5757bc740

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d6b4373e059c5b1fc25b68e6d990827

SHA1
b924e33d05263bffdff75d218043eed370108161

SHA256
fafcaeb410690fcf64fd35de54150c2f9f45b96de55812309c762e0a336b4aa2

SHA512
9bffd6911c9071dd70bc4366655f2370e754274f11c2e92a9ac2f760f316174a0af4e01ddb6f071816fdcad4bb00ff49915fb18fde7ee2dabb953a29e87d29e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a4852fc46a00b2fbd09817fcd179715d

SHA1
b5233a493ea793f7e810e578fe415a96e8298a3c

SHA256
6cbb88dea372a5b15d661e78a983b0c46f7ae4d72416978814a17aa65a73079f

SHA512
38972cf90f5ca9286761280fcf8aa375f316eb59733466375f8ba055ce84b6c54e2297bad9a4212374c860898517e5a0c69343190fc4753aafc904557c1ea6dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e1301f3e05eb5ab6ada21d8266152370

SHA1
d2c4a26f48840bd7f3a979483265ee12759cc434

SHA256
ea172297a8286f04e1f2bdc7c5214ea932b4496883374ce9745813602ba7cb8d

SHA512
7c23f494feaaae322f0be2a828c0006a98fddee13acecb4a3a2c42138d0a95abe6673defdb1725815cb1cfef7122ec0d2632e9142f0c34cc090cd536181b16f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fa31b7e37080887e2d6fada73dbcc03d

SHA1
34b9c9721f63b71f940b55c46b9626df798a77a9

SHA256
e7d1c461fc3b46d2ae2f153530c868352e2eec18212430437cfc040dfcb24d25

SHA512
0c6c1706a48eac4cb0ef05a662854d2e572b2bbd27460a8ea7e4cffa2b91f96c4a1fc64610c323fee4199c4c9da67a1e00ddc75aaa4486a1b2d195f0a64464c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
8567e1f2692c0b6b22ff80d629299c19

SHA1
58cddc76e9ff5e87f484897575c3a00f748d903e

SHA256
401da02959aad39d1b085fb55389b5f8ca4ee9724f7ced382eda6517490bcfaf

SHA512
4c94507f7f61227a4f10c6380e132df75d8698fb737b635e78c1c2a280b3313f61069eab4117641ae862b228e791e207960ea267fbf201618f6c2a7671a505e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
46fa4f5f7344089589d117bd7599b3a9

SHA1
b6cc1fe19e527d4a372c97e4d195ed94eee40030

SHA256
223280d95a13f1af6af06459bbf230874500c212a2e16f63914eff3f22e8b57a

SHA512
6b680aedde7e806802652aab9ab31cb21438bc8756b063955e6f03bbbdf1273f7d47c40ec1a19fe27537afeb8d6cc219a246d31f7c6822b481649fe296e2a45c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ead5a098eeb7536875d41013b929ee98

SHA1
8aad9149620ed54fda53f3494c94eefd7bff82a8

SHA256
02ac05cd7e85efde315d68d013c640e2a419ed6a02a579d2462cd1816fb69001

SHA512
0b0bfc52f87e3b9fb3f0a4f89b675b4a650e96124b98319324d9c95873a4649bd88ce69a1930bb075d340d49a9f073530426d03ba0a4b0b32a756156b610a886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
730f5f68eb1061086198ea7f79518197

SHA1
d567e29ad8f0269306d5db5ee3b6c6900bf4101f

SHA256
d7bff89c9e66d2581b24443dd5b2498d1019c891abd7f769cc6423519a60564f

SHA512
2d438f9c6281fac8f5f32ba0c457a0729b4649a1b1f82ae773e5c274a2fc6f1687e5b3ab5e66702362915aa722f92708286ea4ce0540d9884e05dbeca406ffc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33c52a7311ce1bd439ce0d6af694eaf9

SHA1
1a2da728d8d228750dbf1aa0f000eaed2490a609

SHA256
71033eaa377a81a722cb11d91e72dc99c9ce2cbbf5bef2d8de97b7c4d31395de

SHA512
199aa9c8eaf8212c646c36679660e3541e10bf5832f29d47cbf7a5557a627508edc63379fdfc8f564a9706180ad71897b6f097a30158e9565716337d1d7e10db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e55eaca916432cf23e83107dd16d280e

SHA1
164cd1ac9454ff3419bb164751aaf04ba92623aa

SHA256
1969f002ec2b767061e06c30806914725b35b7fe91f65ee7562bc4d7ff68c088

SHA512
065e301f68b64333d17f22db5214a00ef9481b30bf999ab4156f32f6360f614f9274be77b54abcc51025d098e2445a0c8a6600f2ebcf1f8ab7ba77073c5f984c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ee6db1736f518a102e7fe1de08b8ef42

SHA1
ded5b589c87b0dfea67d565301343de1c20869b0

SHA256
b87b5de946c16bc96c81c95c556ac3e55e60678d7270acb8dff7c0be290408c3

SHA512
8fca710e409a25f774c2fde6c6cdfa9a29a5680f71ff319ee1cf1fc606e7645c0093e29c2fc73ea8cc58d2a8e620f90754a74dc264a119e870bba9c6c8e93fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dea309c19f8a3a0d13017b0b987afdf9

SHA1
e87420f086cb392e3831919c7dfe2108cf001bc9

SHA256
cdbea679b9b04b5c538d8b56e3f19b68b1ab27adecbb167ccebc5a7007fbfe2c

SHA512
550f0848eb4d10fd93eefeaca18c1b24e0702a39e75fc94e12a7a9fbfe47dcfb4a2f295e833a2488f4386c592a7266bf72c5064f1c937b795522755ad1333d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\820e294e-9c37-4e32-958d-48cc912e7290\index-dir\the-real-index

Filesize
2KB

MD5
76cfb7b552e1abb45979439664a70880

SHA1
6a4d4ea80d0cee6b22251f612380755fe15225cd

SHA256
ce2943b12757ebb0cba9e5300ab72b5668cd3f17eb61decee09319c7ffa7d4c9

SHA512
3219b5fe899df10ed6f8538b38c650fb08e3f875f24523357fabfca6099d27bb375e8e048f5928ce9c89d5aa7af1744872d1a3140f1ea5a74cb0437fc854436a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\820e294e-9c37-4e32-958d-48cc912e7290\index-dir\the-real-index~RFe5a4816.TMP

Filesize
48B

MD5
83eae8d123deac116d92929906b9ffb0

SHA1
6be157be0b30f01c8673c76b5f029c4e48928fd7

SHA256
acfebe2b92b843b2196b2964f4e8b340d701825571fb71ff33da3b37e945cf6a

SHA512
beeccd5f153bf553e9bbbe070f43dcc0765ca2b231da685cd082401809044e541b8d0a3f0b7490fea244270ca9c0081a55806eff86bd2b1381f60c6de1f5bdca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
63b0409fde22978a17bbb23115829537

SHA1
4f89d8d5d6614e21d3ef6c5f4a0a3714a87fc670

SHA256
e01824c888550b71efc422e1a29125ea34f952f1161dff80affdf020a5e27d5d

SHA512
3b464bad8649d2bc4ce26b88a9ce77fc069fa60769fd3f50f4b1e26d6bc765c18ea304431b21a6dd21ee73cfc8e7ac57a337e5cd5100176791fb1d04a0546131

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
453cfd7d29914c77a815ee99dbc861a2

SHA1
60085a0503e2862565a05ab5f6c448ecc507d9b4

SHA256
40cb81a38a316dae53df733f03a42cc7582964d5e5fe432dd3335e0a6e846e4e

SHA512
a490932447b449ad370b88ae8e0ec4aa0ec2567d5d8ef3bf4b35c4f387b99a2f545e39e43e5e1b272d4f761e6d861178504e35467ee1386b1c9b54bde0131e65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
47b7098cad13ea875230de67aba2af04

SHA1
6e5de5a2a45a480a76bf271661d8ceaac8c5f30e

SHA256
5ea6a94d5e889c0260cb11491ca298f92d4c6dc5f191af0f42deda573cb2b5b2

SHA512
5ef5e405eef2f7fd553a00e2ed30385f54938c259b8cdef1efd43a423364d357598ce31f9c0613e15577594a1e190fd4f3c6e939ada3e285d73b3c1dc1fa7482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a3431.TMP

Filesize
89B

MD5
4835c9cd3f15094f6112b60153e41dc8

SHA1
0d4da968af41a64672654bfe247c0f86fae20f98

SHA256
f0c080b6d9d5e7a9f438e634ecbbb1ab645199f259359dd7e1c33e3a2c06e8fd

SHA512
4e1ad6aae6935c6d728c57bab660d4afc083c1f8801a17fc3f3311ced8211e3d76a5705a0beed45372cabf006ca04769a5957b97efa4e1d443b8d0958719b77f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
48B

MD5
e21cbe8048ebccd42b15eda36b26e888

SHA1
c4d6aa5ccd4cb84a3360b99fc2a28b697fca394e

SHA256
37aa94cfcd898aaf4da6dc34620221e63b429a9ecb58034bc53fe8068cafaaf2

SHA512
f2f9cc623ff4d5a091d735263c36751201b67c1ab1f815b81a6a7a6c53f51e043f3a0cbc8b9b841a6ba3922341424b1f23dd3e6c14c18b960fcebef398a0865c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a9627.TMP

Filesize
48B

MD5
6bfb8c68c95e640c10548d5a4de42322

SHA1
8e8a427699f29812138cf5faec0e15b144cf04bb

SHA256
713ef5a43156f369e2e12ebf8ea86521a5f6adae67fadb645e163d7f7dcb9f63

SHA512
90f1fd18de1bf42165a214443792922e96229051fff306f40ec65fe8b01cdc9a5e431b6d2cf67499dfb22ea3cd4dcb4b8292b1e1479d6b35c2b47014282bd99a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a27d048d176a9b2b7b8dc2088967f965

SHA1
0c56bf21be60b1d6ee88fa6278f7247004eb1f9a

SHA256
532ac8c958dae1310a361c9581d9cbd29780d0c379a23eb0547f0a628432426b

SHA512
297319a3163690a3b03155b1c7b023d50d66efa9779d57e848c973f5e13b77f0d0825bdb70c581236fc2cd91a8cfccb96179684c00dae0ea8577d9f839f655d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a6e22b2f6a498a6f2e747ff6780405ba

SHA1
1f54dde4ad42eecc8a0278365b6c1483e8a5813c

SHA256
8dadc3bd26937fdcb448a301470e887f783a98920ab1b04b83094694c95fd654

SHA512
03dedac1e5cf18be1f28b8f2b485dc1b05906b97742102ba518730984ba3f93315e203ea0038b947e4d2a1890a00f24703343dfd669e209e7d72f81d40430254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3e2d06decc7c0c4a5fa6291983e15495

SHA1
73bae57a79e80ff6a0d562f19ba942643aa1b41f

SHA256
33dc5f03a50ea8fc0b53b98e9155291551dac400dda1dafb3c909502443d6001

SHA512
31a642505c2dae4ff3e274511eb8133659f70c1d3755b0afd1cebe656fe94988cd7a97421992308ed178f7a166217417ec170dec7bec7c37afc8413fa9516486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f4544ff9780717a9188dace9f451c759

SHA1
97d90f3b801e94d6902df05099e19eb5139d3b44

SHA256
3b324aeadd2f78a5337347dfc98649b6083c2d85add1bc88961e608cfafeef2a

SHA512
576fb9de399f1752ab96cfbeddc9020656da5930941b644db7c020cae1980a29e6906b5f2209ea943f98612614c5024153d220ced497d3a94ca7bc7eff77d987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ce88f9f853a98dc7819b2dfb81dcde63

SHA1
549223a50cb1920ea1ea621362b09b6758eef751

SHA256
fcb6e6dfc2f5e62239d53010805b2c18de7b2e7b88cef396d3d4378bed339e46

SHA512
1a73a664a37880a110613a0c7ba98934ed1d36331f28158575e03445dc5574245b32ceaf4ee70e5b6f8869ee6f93ca78a0083e1cbc4cf547854837c23e2ff99a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f8b69f9313d19008086e154e9e930aa8

SHA1
35cad6d50906518063861fab65cf714ea79611f2

SHA256
ec7441017bb48983c76217bf24ee93faa6f74b381bd94e6ee7e212a9e4b7f4b5

SHA512
9f0bdf8cebae70f1be83b4a3fdb663b80c935ddee261ac9af784fd1eb1e1e79c96a966dc46ee197935e6183a3673ebde79dd1ab110efab74f3053ac08c062711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
148de502c09e90ec1dda5c16b62fc65b

SHA1
7efe690ddeb4139a45cade29073e91f8000b469d

SHA256
67a78af0a76580e380d9ea485f4d2b2b11600bbab61ab6c958891761c49857b7

SHA512
70aa1b21d8f23a45049a2a7d0465503a2fc3aa07de433aba6c80b57d7252384577140a9516c709354c3d70447e21e9eb4d1cc64f6c20a811e542fe079903dab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5821bc.TMP

Filesize
874B

MD5
e1a0c041dd6a7b732366425d47faa404

SHA1
edff4f2f0a3988fde8f84950d9296c27f2a4c21a

SHA256
dc70fab553e2c1a580edddcd2d201443fc33275e5033c9150d11b53bc775da3b

SHA512
e56d8a210e53df5ce3845a8a88b5d25182cc78e6e45f17891c3f8d4b40d36de4d457138be0333393113b0a8eee54ab01d9137720b7d82a6a05d619d3bad23985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ffc1a4f45c5380d89663374698fc7484

SHA1
fba7863571b8f17cfa99abaaf6f07103b10d13c5

SHA256
561d46afc7851e8bac74ba96e7669ea6f0e7854551ac302682a17ae7e18f3265

SHA512
813372a31577d18b0868111cd99d78040392c92372d3302d280c6eb732a2d76b503e68512a9732e362b63727e0596007678c2ccac51bc0b53608f6576169bbc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
88a4cc7e908914d5e1821c582dd1123d

SHA1
08230b98279b99ed797682ec35cf4e301ad787ac

SHA256
0d27eb9853a4118d9edb5a21aae3d84e68561a68a91656e13076744ebbfd6bb2

SHA512
3d27c246bcbee962a7da20a184b910e891902be2f499fe2bf7b3b67e221052b2c3af12636c870df447a32cc5b28be3198991b28cba55d6961c831ce37f7aef43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0b85443c89d710f22b115e15ba13676d

SHA1
8cf6fe52f037e0b60791b5e150df81ff1c88227f

SHA256
2af2d0de2287c788875305108d45d6c98d7f129ff2253e9827016ca7be0c7d94

SHA512
0c09814707a38267a7681ab98ac3b799036f24b969ad7c3114661e0c35d46e5a34ec322ad72fed4189f12c95c3c14c812797040f8681e5ba4cf7eb461e3e44f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0950270a1e8927061369a0f11fee86bb

SHA1
23dc4be8ce023ea685a7d8804cb0bd24f123701f

SHA256
0a29f3969c7af76f5b5534c47e5ca9023f2989bbf1f62507ea5e905a1a7df89a

SHA512
a5d3b2114e5f30f8132969d6c10aaed26742e96a63b073c3d3da51a745e92e7eb786f0e8533152c0eace4827796cbc666a1ea44d42372ba3f12f73d4de0ba6bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
85c4df4b2f4d27ce3a75e69895c5bd40

SHA1
c026de61a5c29081387b60f34a906c7f44650e87

SHA256
ea7a320f1dc4eca6a418057776dde4ebfb6a840e4c598eadc03c13dd2a4fe7a8

SHA512
891552d8e59d3cd61d744896866fac01441fc752f9cdad58cd41dab9eb5b4ab7a4c65b9e471ad493bae90cbde0c30177b481f9b6211e15f72985b644935f00bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
c43a1051522289b6e9e9de9b3db2ebb2

SHA1
6599dd944ad143497552ed46f69a2a5afaf2b279

SHA256
aa0a00fc33bcee0c9c23014c65cdd0780fd19e052de27402dcef10956cdbe614

SHA512
d0646b63fb718aed88904b2f6af281c2c7fd3ff5c1b80828da941ec4cddc6c245bfcf47bcc118d92eb89f8b792003245952bf9df44f88e4961cd59b39a96af29

Download Submit
C:\Users\Admin\AppData\Local\Temp\96485E00

Filesize
23KB

MD5
529c792c0d6db51b0c07bfb499006879

SHA1
186499401d109cd3685071ed6d2fd9bf71855f38

SHA256
9652b84449576a465c4029dd65c5024542713fc6fefe1665a9269fdfcb09ff42

SHA512
5d09114ad219738eb995a2bfe5723566749f63e68aba4a86d8bc81d9b6da790eeb7f11932dece4920a95ed62837e2261a760bdacf66d7eb61e571b506e8090ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\gqzZEK5v.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\Downloads\._cache_Blueman.exe

Filesize
14KB

MD5
184bd75eebd7df441f1213572bf8eb48

SHA1
583e39aa931b1932b08fed0c50b09d4c73edfbf5

SHA256
c96b00e3e5cb9c157e20fff1889c1c1ba99c4449147a5c70cae75757c0477831

SHA512
32338dbb568ce0baf9acdc0d2d4322b309ccdde91c6799b5ca8431e8bb6bf8ed6e3e42f7a432fddf9a6083bbf8736d98ec442d1d2a7a5862efe1d7017485db4a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 121724.crdownload

Filesize
768KB

MD5
be2a93d0adc2d1b29840d96521ecc0e0

SHA1
92497c17f7f24893c716ae56973c4ddf093cd09f

SHA256
14856c638f4322cf97ad138629e315118f88f4e8ea7bbc3b99a8ec59e1d47a70

SHA512
e89d55dcf073a915c203ab4c6e44963387f0327b4838b22c7901b0863d247d20e538f23b8aa8f1ec52cf99a2a208d0148134fff45fa27668745c9e7077ff2c41

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 193866.crdownload

Filesize
202KB

MD5
46213d88cf0ec128340d5bdc2479d1b9

SHA1
2e8f3621f860beddf4985a9f5bea2863542e4a7d

SHA256
82b489067d0a1a9c3fb525b4f9a48dc709d4a3bf3d4a881b44e5c98283b1e809

SHA512
c958db74258699c324c7ec1fb14f03b7a71a4ee7a6e2bfe7a479fe9e7926e1afc99ba858fb613a65cc8c99559740758d162d2e228007cd0f7fd29b5b11ce651b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 193866.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 544411.crdownload

Filesize
134KB

MD5
0afcd7ca960cecf358f0ed09c8c3bfdb

SHA1
5485f19e7c2bb065530307443d44374c3706f933

SHA256
77df13cb8fdac0f93035d9df79c94ebe5f1d701ef0133a7678fab9ada60f73f2

SHA512
5242bf7212ee87f5561cef9d84c3104b825ebb01246026912cf2dab719e96dfa7ddc4d60d56903cfff47732322365ad9d47d6488e39657ce406eaa7dce155d2d

Download Submit
C:\Users\Admin\Downloads\venus.exe

Filesize
13KB

MD5
799db11cbd73e355902ca0e9611a2055

SHA1
98cdb0ecc8ea2dbba95b99bd73a6f6a357123216

SHA256
794f4075e654255924fd2c50051127786ef5fef1fb57bb7e216ade23044d9873

SHA512
5d6920fa75c2723e03cef6ee9575948fa445db6e3ea5d90ea8ae366fa9e25f31c6e44e327e0812c570fa6c31f9fe714aa5a078eddfdf0dc42dccbfb5f404e2ba

Download Submit
memory/544-563-0x000001D9CB240000-0x000001D9CB241000-memory.dmp

Filesize
4KB

Download
memory/544-568-0x000001D9CB240000-0x000001D9CB241000-memory.dmp

Filesize
4KB

Download
memory/544-566-0x000001D9CB240000-0x000001D9CB241000-memory.dmp

Filesize
4KB

Download
memory/544-565-0x000001D9CB240000-0x000001D9CB241000-memory.dmp

Filesize
4KB

Download
memory/544-562-0x000001D9CB240000-0x000001D9CB241000-memory.dmp

Filesize
4KB

Download
memory/544-558-0x000001D9CB240000-0x000001D9CB241000-memory.dmp

Filesize
4KB

Download
memory/544-557-0x000001D9CB240000-0x000001D9CB241000-memory.dmp

Filesize
4KB

Download
memory/544-556-0x000001D9CB240000-0x000001D9CB241000-memory.dmp

Filesize
4KB

Download
memory/544-564-0x000001D9CB240000-0x000001D9CB241000-memory.dmp

Filesize
4KB

Download
memory/544-567-0x000001D9CB240000-0x000001D9CB241000-memory.dmp

Filesize
4KB

Download
memory/1340-674-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1340-626-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1340-699-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1340-607-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1340-528-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1340-509-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1340-1136-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1876-439-0x00007FFB0DF90000-0x00007FFB0DFA0000-memory.dmp

Filesize
64KB

Download
memory/1876-441-0x00007FFB0BCF0000-0x00007FFB0BD00000-memory.dmp

Filesize
64KB

Download
memory/1876-436-0x00007FFB0DF90000-0x00007FFB0DFA0000-memory.dmp

Filesize
64KB

Download
memory/1876-438-0x00007FFB0DF90000-0x00007FFB0DFA0000-memory.dmp

Filesize
64KB

Download
memory/1876-437-0x00007FFB0DF90000-0x00007FFB0DFA0000-memory.dmp

Filesize
64KB

Download
memory/1876-435-0x00007FFB0DF90000-0x00007FFB0DFA0000-memory.dmp

Filesize
64KB

Download
memory/1876-440-0x00007FFB0BCF0000-0x00007FFB0BD00000-memory.dmp

Filesize
64KB

Download
memory/2280-368-0x0000000004FD0000-0x000000000506C000-memory.dmp

Filesize
624KB

Download
memory/2280-374-0x0000000005080000-0x000000000508A000-memory.dmp

Filesize
40KB

Download
memory/2280-370-0x00000000051A0000-0x0000000005232000-memory.dmp

Filesize
584KB

Download
memory/2280-369-0x00000000056B0000-0x0000000005C54000-memory.dmp

Filesize
5.6MB

Download
memory/2280-407-0x0000000005330000-0x0000000005386000-memory.dmp

Filesize
344KB

Download
memory/2280-367-0x0000000000740000-0x000000000074A000-memory.dmp

Filesize
40KB

Download
memory/3660-365-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/4948-637-0x000001F467340000-0x000001F467341000-memory.dmp

Filesize
4KB

Download
memory/4948-640-0x000001F467340000-0x000001F467341000-memory.dmp

Filesize
4KB

Download
memory/4948-638-0x000001F467340000-0x000001F467341000-memory.dmp

Filesize
4KB

Download
memory/4948-630-0x000001F467340000-0x000001F467341000-memory.dmp

Filesize
4KB

Download
memory/4948-636-0x000001F467340000-0x000001F467341000-memory.dmp

Filesize
4KB

Download
memory/4948-635-0x000001F467340000-0x000001F467341000-memory.dmp

Filesize
4KB

Download
memory/4948-639-0x000001F467340000-0x000001F467341000-memory.dmp

Filesize
4KB

Download
memory/4948-628-0x000001F467340000-0x000001F467341000-memory.dmp

Filesize
4KB

Download
memory/4948-629-0x000001F467340000-0x000001F467341000-memory.dmp

Filesize
4KB

Download