rhadamanthys | hxxps://devsploits[.]net/xeno/

Resubmissions

13/03/2025, 03:04

250313-dknr7stqt8 10

13/03/2025, 03:03

250313-dj2bxatp16 3

Analysis

max time kernel
203s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2025, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://devsploits.net/xeno/

Score

10^/10

rhadamanthys discovery stealer

Malware Config

Signatures

Detects Rhadamanthys payload 4 IoCs

resource	yara_rule
behavioral1/memory/4504-795-0x0000000003F30000-0x0000000003FB1000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4504-798-0x0000000003F30000-0x0000000003FB1000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4504-799-0x0000000003F30000-0x0000000003FB1000-memory.dmp	Rhadamanthys_v8
behavioral1/memory/4504-797-0x0000000003F30000-0x0000000003FB1000-memory.dmp	Rhadamanthys_v8

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4504 created 2656	4504	Nightmare.com	45

Executes dropped EXE 1 IoCs

pid	Process
4504	Nightmare.com

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
3992	tasklist.exe
3180	tasklist.exe
6000	tasklist.exe
5680	tasklist.exe

Drops file in Windows directory 54 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ElectricalAppliances	Xeno.exe
File opened for modification	C:\Windows\FramedHose	Xeno.exe
File opened for modification	C:\Windows\AnalyticalActors	Xeno.exe
File opened for modification	C:\Windows\OptionalWright	Xeno.exe
File opened for modification	C:\Windows\DodAnalyst	Xeno.exe
File opened for modification	C:\Windows\ElectricalAppliances	Xeno.exe
File opened for modification	C:\Windows\WebmasterShowers	Xeno.exe
File opened for modification	C:\Windows\WareVariations	Xeno.exe
File opened for modification	C:\Windows\TaxiValuation	Xeno.exe
File opened for modification	C:\Windows\TaxiValuation	Xeno.exe
File opened for modification	C:\Windows\AnalyticalActors	Xeno.exe
File opened for modification	C:\Windows\AnalyticalActors	Xeno.exe
File opened for modification	C:\Windows\OptionalWright	Xeno.exe
File opened for modification	C:\Windows\DodAnalyst	Xeno.exe
File opened for modification	C:\Windows\OptionalWright	Xeno.exe
File opened for modification	C:\Windows\FramedHose	Xeno.exe
File opened for modification	C:\Windows\ElectricalAppliances	Xeno.exe
File opened for modification	C:\Windows\OptionalWright	Xeno.exe
File opened for modification	C:\Windows\WebmasterShowers	Xeno.exe
File opened for modification	C:\Windows\WareVariations	Xeno.exe
File opened for modification	C:\Windows\WorkflowIntent	Xeno.exe
File opened for modification	C:\Windows\FramedHose	Xeno.exe
File opened for modification	C:\Windows\WebmasterShowers	Xeno.exe
File opened for modification	C:\Windows\TaxiValuation	Xeno.exe
File opened for modification	C:\Windows\WareVariations	Xeno.exe
File opened for modification	C:\Windows\DodAnalyst	Xeno.exe
File opened for modification	C:\Windows\OptionalWright	Xeno.exe
File opened for modification	C:\Windows\WorkflowIntent	Xeno.exe
File opened for modification	C:\Windows\TaxiValuation	Xeno.exe
File opened for modification	C:\Windows\ElectricalAppliances	Xeno.exe
File opened for modification	C:\Windows\DodAnalyst	Xeno.exe
File opened for modification	C:\Windows\FramedHose	Xeno.exe
File opened for modification	C:\Windows\DodAnalyst	Xeno.exe
File opened for modification	C:\Windows\ElectricalAppliances	Xeno.exe
File opened for modification	C:\Windows\WorkflowIntent	Xeno.exe
File opened for modification	C:\Windows\WebmasterShowers	Xeno.exe
File opened for modification	C:\Windows\WebmasterShowers	Xeno.exe
File opened for modification	C:\Windows\AnalyticalActors	Xeno.exe
File opened for modification	C:\Windows\AnalyticalActors	Xeno.exe
File opened for modification	C:\Windows\AnalyticalActors	Xeno.exe
File opened for modification	C:\Windows\WebmasterShowers	Xeno.exe
File opened for modification	C:\Windows\WareVariations	Xeno.exe
File opened for modification	C:\Windows\TaxiValuation	Xeno.exe
File opened for modification	C:\Windows\OptionalWright	Xeno.exe
File opened for modification	C:\Windows\WareVariations	Xeno.exe
File opened for modification	C:\Windows\WorkflowIntent	Xeno.exe
File opened for modification	C:\Windows\TaxiValuation	Xeno.exe
File opened for modification	C:\Windows\WorkflowIntent	Xeno.exe
File opened for modification	C:\Windows\ElectricalAppliances	Xeno.exe
File opened for modification	C:\Windows\FramedHose	Xeno.exe
File opened for modification	C:\Windows\WareVariations	Xeno.exe
File opened for modification	C:\Windows\DodAnalyst	Xeno.exe
File opened for modification	C:\Windows\WorkflowIntent	Xeno.exe
File opened for modification	C:\Windows\FramedHose	Xeno.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4220	4504	WerFault.exe	159

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nightmare.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xeno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xeno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xeno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xeno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xeno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Xeno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "5"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000042822edb4c81db01772cc8945481db0148cde6dcc493db0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
4948	msedge.exe
4948	msedge.exe
2680	identity_helper.exe
2680	identity_helper.exe
5340	msedge.exe
5340	msedge.exe
5532	msedge.exe
5532	msedge.exe
2312	msedge.exe
2312	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
4504	Nightmare.com
4504	Nightmare.com
4504	Nightmare.com
4504	Nightmare.com
4504	Nightmare.com
4504	Nightmare.com
4504	Nightmare.com
4504	Nightmare.com
4504	Nightmare.com
4504	Nightmare.com
880	svchost.exe
880	svchost.exe
880	svchost.exe
880	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	6000	tasklist.exe
Token: SeDebugPrivilege	5680	tasklist.exe
Token: SeDebugPrivilege	3992	tasklist.exe
Token: SeDebugPrivilege	3180	tasklist.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4504	Nightmare.com
4504	Nightmare.com
4504	Nightmare.com
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4504	Nightmare.com
4504	Nightmare.com
4504	Nightmare.com
4948	msedge.exe
4948	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 3448	4948	msedge.exe	87
PID 4948 wrote to memory of 3448	4948	msedge.exe	87
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 4912	4948	msedge.exe	88
PID 4948 wrote to memory of 1864	4948	msedge.exe	89
PID 4948 wrote to memory of 1864	4948	msedge.exe	89
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90
PID 4948 wrote to memory of 2112	4948	msedge.exe	90

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2656
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://devsploits.net/xeno/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85c9546f8,0x7ff85c954708,0x7ff85c954718
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3264685667998758907,7142959517079656001,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:5376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3024

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5784

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_ℝ𝕖𝕝𝕖𝕒𝕤𝕖-𝕏𝕖𝕟𝕠-𝕩𝟞𝟜 (1).zip\README.txt
1⤵
PID:5876

C:\Users\Admin\AppData\Local\Temp\Temp1_Release.zip\Release\Xeno.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Release.zip\Release\Xeno.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1576
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand Candles.cda Candles.cda.bat & Candles.cda.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5528
- - C:\Windows\SysWOW64\expand.exe
    expand Candles.cda Candles.cda.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5768
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6000
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6016
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5680
- - C:\Windows\SysWOW64\findstr.exe
    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:760
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 214130
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3992
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Quality.cda
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2528
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "VSNET" Cw
    3⤵
    - System Location Discovery: System Language Discovery
    PID:372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 214130\Nightmare.com + Purchased + Emails + Devices + Drivers + Congratulations + Avenue + They + Moments + Chi + Independently + Levy 214130\Nightmare.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Ad.cda + ..\Learning.cda + ..\Click.cda + ..\Garlic.cda + ..\Drunk.cda + ..\Cargo.cda + ..\Milk.cda + ..\Tourist.cda + ..\Zum.cda O
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1172
- - C:\Users\Admin\AppData\Local\Temp\214130\Nightmare.com
    Nightmare.com O
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 920
      4⤵
      Program crash
      PID:4220
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4504 -ip 4504
1⤵
PID:1420

C:\Users\Admin\Downloads\ℝ𝕖𝕝𝕖𝕒𝕤𝕖-𝕏𝕖𝕟𝕠-𝕩𝟞𝟜 (1)\Release\Release\Xeno.exe
"C:\Users\Admin\Downloads\ℝ𝕖𝕝𝕖𝕒𝕤𝕖-𝕏𝕖𝕟𝕠-𝕩𝟞𝟜 (1)\Release\Release\Xeno.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand Candles.cda Candles.cda.bat & Candles.cda.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5716
- - C:\Windows\SysWOW64\expand.exe
    expand Candles.cda Candles.cda.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3992
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "opssvc wrsa"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4560
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3180
- - C:\Windows\SysWOW64\findstr.exe
    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5520
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 214130
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3664
- - C:\Windows\SysWOW64\extrac32.exe
    extrac32 /Y /E Quality.cda
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3744
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "VSNET" Cw
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b 214130\Nightmare.com + Purchased + Emails + Devices + Drivers + Congratulations + Avenue + They + Moments + Chi + Independently + Levy 214130\Nightmare.com
    3⤵
    - System Location Discovery: System Language Discovery
    PID:388

C:\Users\Admin\Downloads\ℝ𝕖𝕝𝕖𝕒𝕤𝕖-𝕏𝕖𝕟𝕠-𝕩𝟞𝟜 (1)\Release\Release\Xeno.exe
"C:\Users\Admin\Downloads\ℝ𝕖𝕝𝕖𝕒𝕤𝕖-𝕏𝕖𝕟𝕠-𝕩𝟞𝟜 (1)\Release\Release\Xeno.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand Candles.cda Candles.cda.bat & Candles.cda.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1752
- - C:\Windows\SysWOW64\expand.exe
    expand Candles.cda Candles.cda.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1012

C:\Users\Admin\Downloads\ℝ𝕖𝕝𝕖𝕒𝕤𝕖-𝕏𝕖𝕟𝕠-𝕩𝟞𝟜 (1)\Release\Release\Xeno.exe
"C:\Users\Admin\Downloads\ℝ𝕖𝕝𝕖𝕒𝕤𝕖-𝕏𝕖𝕟𝕠-𝕩𝟞𝟜 (1)\Release\Release\Xeno.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand Candles.cda Candles.cda.bat & Candles.cda.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4852
- - C:\Windows\SysWOW64\expand.exe
    expand Candles.cda Candles.cda.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2404

C:\Users\Admin\Downloads\ℝ𝕖𝕝𝕖𝕒𝕤𝕖-𝕏𝕖𝕟𝕠-𝕩𝟞𝟜 (1)\Release\Release\Xeno.exe
"C:\Users\Admin\Downloads\ℝ𝕖𝕝𝕖𝕒𝕤𝕖-𝕏𝕖𝕟𝕠-𝕩𝟞𝟜 (1)\Release\Release\Xeno.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand Candles.cda Candles.cda.bat & Candles.cda.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2184
- - C:\Windows\SysWOW64\expand.exe
    expand Candles.cda Candles.cda.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4016

C:\Users\Admin\Downloads\ℝ𝕖𝕝𝕖𝕒𝕤𝕖-𝕏𝕖𝕟𝕠-𝕩𝟞𝟜 (1)\Release\Release\Xeno.exe
"C:\Users\Admin\Downloads\ℝ𝕖𝕝𝕖𝕒𝕤𝕖-𝕏𝕖𝕟𝕠-𝕩𝟞𝟜 (1)\Release\Release\Xeno.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c expand Candles.cda Candles.cda.bat & Candles.cda.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6128
- - C:\Windows\SysWOW64\expand.exe
    expand Candles.cda Candles.cda.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5da507c2059b715761792e7106405f0

SHA1
a277fd608467c5a666cf4a4a3e16823b93c6777f

SHA256
8c1d99de087ac5f2e7b2afce66eff36a646bef46800c0c1d7737d6f0df74b7e8

SHA512
01c92729dd8061aa122b116a674c73bb78016f66d2cb8f7fb64907352758a825e87a1e345334386440699d2a6d1e17baccb400c5aee151eb64e64019cbebb870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c6e13dc1762aa873320bed152204f3c

SHA1
38df427d38ca5ce6ce203490a9fb8461c7444e12

SHA256
5c441148843b7c8dbff4c4a72962a532aaf0bdd484d07a03dd9a32fd461b1371

SHA512
133054cb042e11013bfdad1bd11e3407d08cf26a66d0743bea9708d261aa904a1047bb0097b187ecf8436cb6cff3bec28c89e435862cad0e0fa264799556b70c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
19KB

MD5
2bfe3e4017cd3a9661570efe543bf908

SHA1
99e8503b91d475db2b7215ac37810c36eda7adb4

SHA256
8a14bbe94959260c9730b45bea6359d8217df478fab2f123ef4aa0949a40ef5f

SHA512
3bbafa0311879102c231cd15d550b5cc87f835cef41b36831753096c12c1cb17d9f6d76f94e1ee4eda05590a8005b0ac56f3d02886ef59a34ac9b441eebc981a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f03855fbd90117b97ea411b071196507

SHA1
795489a07b5eb5884fdaf1799a00fe1821d8f18f

SHA256
9c0db2124691b8189011a17e9cbcb7b90e4a71977f1c1740de5f9463693e363d

SHA512
96e69f9fcbafff32234d6715536271c526663cb093a73bfdb6d906c4ab996d58bf2fe0844d06ead5f007af82c3c15b186e900f83bfbfe2e5e59766365b28690d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9ae8b9fde02fe30b6cfd6933771fc420

SHA1
779b177a7332cd3fb8c6e2b9105ea972187bf2f4

SHA256
83b4c2726080d2abaecf0ec73b4d03071c3fdd6737fda017114f6b62f4900e39

SHA512
5e2bacaac7db64fabc9b27beff00fccde61981c1d6d328cfec958df9811a1f9d605c1bfe1ca9211949fbb5b7e1af85aaad255e13e2b4ab17690979c8442d03e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ebb686a993a944f7bc8337fc19db5698

SHA1
3b3a8152132c0b016a8280fcdecb87a579637d05

SHA256
e5364e5af05db1d192d49ee5d73d183fcaca2c98c89b7da3fbe3c4998636b8d3

SHA512
a6a1813d17575325c28582dd04064706d00e8c58833e9e53d2cc8003e6ab13f8f3416cf545c19b9224c43b9e5b80d4439698832557ce0786dbef7e2677ddd527

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f5f6820caac370c38d0beb02667f1ec2

SHA1
87c7c0a820f3b969145f7502b561eb656e32ccdf

SHA256
eaf4c067727bb703c9dc09039ad37ebfd84f43e5e04f90f9be7992155880330c

SHA512
a0ba3b277cf599f1c1d3b61bd12a3d0f6005fb4f0d18e54d663d71e7944eec36570b9355b7e13d0a5d284ecdac3e0c3a80b61d61b5b437b7f7bd08be624d7405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
eac1e4c2b1b6e52b6d86368cbd85221d

SHA1
43494fd3f337eef3b18eed1bd237ef29ed9f93c1

SHA256
113251560b124b2b16483e950b509270c1f1021c9aff0618cc991bee49272caf

SHA512
55bbc6303425d6f0b11f364d077b47e52111a45223cfd3c5fafe0ceb033564984f9fa090717d2ce61549402c132f495bccf3e308973bbff4e6abd047b0e555ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c038ae57bf6570f8c9be8fcb542a866

SHA1
6905dc1d2eecfcc9ecd070ab5ae3a80bd42582bc

SHA256
209eecfa56e336e2333e9f832d39523cfead5b601f697a909e2139d18d713a15

SHA512
7c1282a7f6167fb151291a178bc100df4a391b2079d73151947964a3aaf87347458e5c70e0f07c0b8b8d5a1a712593408f1526b6f046067e20cf82aac7f0cddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e7ca006259f33a19df44c38d916345f3

SHA1
7682dfcd69d1c929d663545daf2071e6c305d657

SHA256
e0336e23f81e3c8efd4731222c4cd5c5c215e65b3d29dd7ede2b593e931e61d1

SHA512
c6f5d82dd5d063a8507b67c84840daa2ddadf5b05e03c24c01ad52d35a2232c64401a9e97fe3cc12497341ec6750144cf235817d26ee94e2aed51463cefd6fae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
69e2a00ad30e52d8f23766c58beb9e9b

SHA1
f18d187d07abef023907637478e9aafd472ecb0b

SHA256
f38a4b11217b39c3a5a1f94f1f6bc5071784c99d7871f8863d575dfe1e4621c1

SHA512
14836083406f0bf2cb10d6508e43a5157539cfac37a8a1b799a26507301b34768b054ffc6e7ec924af2a57ce71f0df0d5e92a7c7d0165e04135a85cdc46e6ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
384b7378df215bdaa3579afe0066f8fb

SHA1
ebe261e612a380d6ab019581f16a425e23bde66d

SHA256
c441965e38211d3fa32549b556332487f996717d0104f642292349b5b2c0edb8

SHA512
5c571c54a92ef88bb3a3face1675dfb99ceb6bccedb7ea8fad1f3809a7c8b35890b06f878a80c2fa586936c197db2d2a77cd367f1b4d223cf07a6e647bf2e71f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3deb7d5ff89e82c1fab6876e5df934a4

SHA1
337cb35e5250cfc6d263b2fb1f5d651908eb7afc

SHA256
296cbafb6f8c9977b6ddbe5c4ab36d6801615e6cbf1fee5a304ed49eff0b603a

SHA512
c043a681b49b1992585f3f9cf411fe31240ec2d56956886b0cd16f4132577056d9c2457412529ba9b2b20bead0d93198ec8f0dc1654c4286d562a30a8b03ae55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bb12529d7c5a7fa8f7da10ba1e074027

SHA1
9ee4122ceb7164c7ef2e68533329d3c7a9c7bde0

SHA256
dd047ea4f3157d9bd463df0777877b180232a8aff0f74af0f1ddfae94a23705c

SHA512
5df4a4ff2a52d2048114b090511de16fc96497c4a2ae0d5acfbf2edde194c9cb87dfa721c2df54e284e7dc69a492e605cdc1576f956e79e18ad0643a452a832b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
98674d140ba71a6636cfa932e07ba628

SHA1
30cb1e6b17b8c0b95dd477fa9ef204363210fb4f

SHA256
eb0f9304cf26c99e82208cd51481abd178ade0719bd4b04454041041012bc277

SHA512
6416cf4c74fe78ead3f594da485e156d5cab682089e1f532132a5169ed7b6e2cab8612a791fd92e0f90ab04a8f2990496c569ae6ca3deeb2d8076c2a2053d1a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e3f7bf72cbdba96c1a9c1b6157efa42f

SHA1
12adc662183f480661d67b04901b7fa57e7f9b58

SHA256
ceba48e6805d5efb5edc8074dcaa8c20085b0745a77c10b0f0c1a31ea0688df7

SHA512
355466f903e088b1717a3167c128dbeccf3ff3347db9679574b0f3612bb2528b6fdc9c6dfe9bfef4a2e6cbfedec151230e0ae2edb67411b07b5bea853bc94c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3e3ddfa51bb955539b6b4d2ab05e3fac

SHA1
bb7dd803d798cfeca6393e52ce5cce3f2fc01e93

SHA256
1cc9652384035c459f857ca003eb18e21cddc32c34a3cde775b67c845ab0b21a

SHA512
d47011dac53043e4cf8aebcdc6da868f702e5f576e2422c39d99b6bfbde3ec3c416b1e1608fd656662980d34e7a82f086b4ee726f74eb663072287f10bc13afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
34b4e492d7903dfb96120770a6eab067

SHA1
61308f60a609453a0bcffe7fb7e0e18289a28db7

SHA256
d26cccf061a1762de3b1822ea70dccacbf0082609e11bbbd0fac0086f4d41cdd

SHA512
2f39e62fa7902053f8f40097cb5126dff04c5e3a8953b20473683b8bab18ae18efbdd1f8d8a5d973e109ed83f1ab598a27ebd5c789150fbf43e65e6f144756ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
51a7a4757e2d2a19d0026607317c6871

SHA1
5507a136c1f856545b21950b0a8844e505699acb

SHA256
96516c8c3896e2905a93771d5720c2db326d87f4809b0e5155d8e7fbf4d4fef2

SHA512
a8805d83e83ec784516b400c9dc732d370b5620a35484525a06904dc858071d964e1eced39216db9ada58bcf099b50bf545edfe7df96a9a23eacab6bdad7ddd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
5365bd135028ae0cddd40a71c6ef415c

SHA1
270f39c0db79209511068bff38283ed69c02fd2a

SHA256
79788830ffc389f9c7e6c6864973ed0ed3c6f67bf755c46275dc972efb824169

SHA512
854e5c16df3ce73d2c79e8ac1f94d7b2d77f8f38dc2be7de947bf0ab89d7d44f38cfeaf117ad9c93c712bc603aa56239cde0c07e76e4fa78c186e5fa6cad6bee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582507.TMP

Filesize
540B

MD5
d84738139964bd731fde5b0572d7c006

SHA1
badc51ee0b03a27d111c29661a37d9e3a82b3076

SHA256
533c23d1184ed3770a14db23268bb9e42dbb8f42ffae3160e5f77c9c8d8450b7

SHA512
7c33d26f8e45fe10db2d5e953dc4ece5b7bdde1810b8b0b2d028780a799c15a2504b9d2f3cfab3994030dc8ec522cb7b3b08f649075bf100a250c4cfcb6d5980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8fe98a554e20ddd0627c9b8aee442140

SHA1
a033efea4dcfa9d4b3bfa019eb988adbe2212849

SHA256
c0e582b210c962400c750872eb346f1b2afe0071b4472a4fda36e73efe70ed69

SHA512
1e52289ded70d747852de85f2ab7ba90c1ecf9ba531e72084923f1f6a68c9574608fb432b5721cf924d9b68fc3f9bd984d32715579d905b156131a38c654c64f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ae380c1d92f00b80b51d82ad1bb80f3e

SHA1
fce6c07564b674fdbfb72de7242faa2b111efc56

SHA256
519fb72d4b85984988fe9d4b44d355ee2352a7c4258f0f849aee1d25543216ce

SHA512
f5b3f54e711466bba507028f4bca293b5ac3fe83c04502fb72a19830d81462ee709014af0a2abda77245a0150a253cc43cef0ea9f7e05f4474c13582b25221f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ac22e8455ff3ecb9ceb1cf57c04fec84

SHA1
2e1f6cfe611a622c2d8a71e2110b32abb58fda1d

SHA256
55ce2e35fb0df7ca51706dfd820fb4ad6f37811c68cb91516fa7ea7fa7b620b5

SHA512
db3a1e0d22ad32db235bdbf3a1123d5c8949ef46301f567675fe6a001160ce44b3d7414735167aab23c8b701dd4382b80ffbf49fa09f7970b62202982940d008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
72a5cbac005ae20aae0dfe66a594373e

SHA1
e27106922d64ec88fa6caeb74ff9f5e3abf59b44

SHA256
f482d3e3a008cf6a34f3f98a8b1094ccd969f83636ce7e26f67c1e0e60130417

SHA512
ec4fccf04bdb95146ab2ddffd3e735c834a538ebd5ad3de96ad667bb6c7e63e200e5ab462c80e24702875db1db6ce51bf4c1832ce2289568720789630b990a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a4485ed83e09b410d02836b64ec6f034

SHA1
b1d361b5573109899d3c9ce628e9fb487613934c

SHA256
52ed6a3b81d89ced87d1c904f37e61582ab253b6bf4323d59fd34809bc140e6c

SHA512
456e9f88e8fdc4cbaae7e4e689d9fc835c1c14c5fddccb33b3ddb1ce317a67f22b8d5cba14840c7ece04f04ddc85630cf715231a679f7be8fa68714869f9bc53

Download Submit
C:\Users\Admin\AppData\Local\Temp\214130\Nightmare.com

Filesize
1KB

MD5
8e6968e7265e6d3029155ec07f4f0802

SHA1
53a333ab5df26c65b050b29ae8ef379ed94d95f4

SHA256
eb46b1dd968a78b130404c05b6203b37d74b1ac37c6fc22dee59bce7f33e3dd3

SHA512
adb03a2de256ed3d33052853aa409aa610f4e7f442e3bd23778e7bc2e21fede18a0e32ef0a9866ca5dc92054332e884840737a1e0001502571ddb0ea14f2360b

Download Submit
C:\Users\Admin\AppData\Local\Temp\214130\Nightmare.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\214130\O

Filesize
663KB

MD5
29da1cb69af24bf91a77f0a5c9e1ac56

SHA1
63cd695b8b0359bf0498fa31ff4a0e8e61a25127

SHA256
738dcb250a9ca55ea0f8b3f9a98ac556c96bb9833f31629b185f635870cb3015

SHA512
72c55a3c8601b86004bf91b90ed12f1519897a78759876fd60ce8ee4e259ca4f0a1a1ffdfd88ee73d0d39759643789648f1e5c6c0aae4fec2c9ecc8198169e9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ad.cda

Filesize
97KB

MD5
9d76009030cebd2b61637a2ff632633b

SHA1
2594cd1ffd229cdfbbba6af8c3794d909c4a75c5

SHA256
2f3da93ec99eda38f4e0c0e9b4f43d4d11f230a5a415879e80ae5025e52ec752

SHA512
6ba7e6fa500b5c99a8c3c8b8bbf94b91b4f4222b715616e32bcb89d5217cef3ba783df3ec5c1fc7617661123d7ec67d2ebac079e2a9a526ea308587731c37e5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Avenue

Filesize
95KB

MD5
ffc7bc4c479d6ed4afedc7a0bfc498fe

SHA1
ea4ac12ea36bef6bf48b92f06a024828e747c93d

SHA256
9a6e8c7c4c77db65411fbf0544488f442fc134a1e9674bb95ea4f22f7f8e23f7

SHA512
128f66d832c96b1f47859bf284e226e868ab03fb9abebb979329a25b1a20b4d677623d418d5a56573900a6fbcdfdd6a750e62cf9dfee267a3359bf33a7af0150

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cargo.cda

Filesize
78KB

MD5
deead8c5c5156c81b433581e467d790d

SHA1
46f905214114233c659390ca79a26bc7ea867b22

SHA256
59b3a1f07a81ececccf8e74dec98b3c6bb3d53819a7f2379d7ebe8df95770ce8

SHA512
9a8feb225a56b911dc3288a82730df28af6901c3860b3bcc95685b2456672b12afdbd45a14eadb493b70e472eceeb04ef4225f0ac059de330c72909a7b6eddab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chi

Filesize
53KB

MD5
900676974b1eafd1a8646a935d14b22e

SHA1
3897d81c81f68f1e873d266fd237021250d76491

SHA256
5da863d069502feb391748ff78eda59812ad75dd02b47e05d2ef7d874bc5293d

SHA512
cc45f6bf0743c908967e89be3823773b77bbf9c3515291e6a544b73a9bc9d2158f0af89bc6cdb84580a580ff5e9ff02a1e2e68fca81bc15a78992fb414cc62dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Click.cda

Filesize
77KB

MD5
2cc4d93a13a0947770bf71809db7a6ea

SHA1
d460140e3acc6207655c7585001bd5b88cc748e6

SHA256
55a7561c01b246e6a769bb64b3e306bbb3b12e190afbe1fd020dc91f0bbf58c6

SHA512
b67155b3f4f1171ceb9dca650d5f01576cc2418ebc697182fe16f1580a9f964ed27f5b1c4902a53854956add2a52a02ec27ebdf000d174a6a555ecb070b7e847

Download Submit
C:\Users\Admin\AppData\Local\Temp\Congratulations

Filesize
80KB

MD5
ee2fe2bf5afc597a25cfa2dc4585fe69

SHA1
6ba68ff319432c1c3b0ff98e720d48c67d217eb0

SHA256
91dabddbda26df9609f32bf6093a6a91099fc8e7e9c6727885ff7dc189ac5284

SHA512
1540ad7c9c70c455b868274e63e8c9648c8669c77f6ec480182f00116cb6f45c0677022e169dfa6e53737de40c1373f3b3c20a9f7be283b0e02c0dd58a6cf52e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cw

Filesize
1KB

MD5
b3be8be6102401e7b8346c31aeb2bd2e

SHA1
f9120f6113facfdf486afd7b38541139491eb01b

SHA256
47662b07301483120fe76c90bbf86cb7b3d3ab41ff891b3aae5b6f5877377ccc

SHA512
006f64ad1747ac4ea730f4a382ef5951bf27b658324b06df0f49587893e47d7dbfbfb2d61da0cf267c16bea602d5cef76e342787fb9ce0cc111dbbef0d1af92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Devices

Filesize
137KB

MD5
24904b6392768beff8e080011531124d

SHA1
a403635bcec18f8409c190e947b5989cc39e3817

SHA256
fd70de521583bc3868ff2712617eac86d2f0dc18f7b3d871f8189b8c12deed23

SHA512
6a1f88cbe53f371af6a2533781d409aac823872764b5996592dda3776fed555f3338a9248d135a2088cbf43725226970785aed9c93e82fe48c421d10196ea699

Download Submit
C:\Users\Admin\AppData\Local\Temp\Drivers

Filesize
51KB

MD5
f790605f546d2e687345badea26862cb

SHA1
2c7a3eedfe402944f1b147cee0cb9151ed26307f

SHA256
4474264672b3aa7cd73e1c98c1a88e4debcafb34b106070332b751ca7d1ecc55

SHA512
0a994e8682b17300ad2bdd72a7202294c56fb59397ec18179706025fdebd971d478006915b4a06502d6f523854ca2fb0c16a855dd27f53d1db957fb6b4709ff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Drunk.cda

Filesize
81KB

MD5
b53b44452048d1f79aab4187bd7741dd

SHA1
b6033b3915594c07fd48bdac2054b266e9ff9ae4

SHA256
496f9fd798ca8aa06c9304fd5d73ca371ee7497908bd74d839b37d95b07d81c1

SHA512
cf69597c03d01c8a6811fe98cc683d8f962ecc9972cf7251108779d32254258774509d0ff57231fba9b78f428456a0f55e0fe4280469c9a63ee75b1f1799e0eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Emails

Filesize
94KB

MD5
708a8b180364bae1dad0f35c22a49276

SHA1
c21ec42fba3bac16a946466d70fefa36ca0ecc39

SHA256
deb72b719c04181290f95ac6fcf2ffa26c06e2b15f270a67bea4f4d81ded1bba

SHA512
44c3e8896b7d40617338172886a1450793bf886c2c3ca9a294fbdc77dd8ee7781a5c9143aabc9dd7ad041ac6a6b3ecbf8647f55f7439577993d5498159d83fe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Garlic.cda

Filesize
53KB

MD5
6da52d95e6fec14420174ee774eff497

SHA1
960d55684db66614560ed129be297ea99669300c

SHA256
122875092db6fb3b79bcf8d5b5cf7cb0651ed96291a0aa7670ba674330dc59d8

SHA512
e89d8634921d369f2d996f007a198358e21503449a14337e82406425e26447c38b666b745e9ab1657d50cf8c961dc0c048ad769a7796fcdd0fcbb01b86154409

Download Submit
C:\Users\Admin\AppData\Local\Temp\Independently

Filesize
92KB

MD5
6b0059f6ab4dad979a5bbdd008ae9ea5

SHA1
07199d632b794a54df8a026d8131e188c4e1be0c

SHA256
e044504ad0f0c1a5d9743613a0f2598422c67b8bb33be9efdf1b32929ec60c28

SHA512
684849bfbe38102fffb66243292013e7c0e851bdb5cb72d6f925e857db84f85f9359f14512128edaada304d24e59a28157a10ae86ebdada0f602ecce8e49527f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Learning.cda

Filesize
79KB

MD5
2447add9ef7fbc3db9f1f533514a2490

SHA1
ef0886005c946cec8f450c644ddf219f3e292715

SHA256
82f980ac40c070691fa4264277fb089ec87dedff40d889c7ae6cfc5f21ffe051

SHA512
dd84ded149e80fec88f24d7daeb911b4a2e842779ec21405b100d7c1859fa1f3151d4f9413783359a367c990a732a7090070380735022806f27d4d610d6b06cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Levy

Filesize
49KB

MD5
e39196aeef5d2e2d043d0743036453c4

SHA1
00c5f9c28add71a8f28ef19569bb93724b2f2c3e

SHA256
b57aa26c8df214c42d76839e9761229d3de4326375bec31cc71968ab6d0e93b5

SHA512
41b86ab1825f6c4c6b0cfca461dccc890d301eed03009cf736b5ad53271275ea30b00a03067ef9f4b5d22b5a623e1299a4b001d77da2164261e8d37eec742cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Milk.cda

Filesize
63KB

MD5
74db0d44d20d089c9b96910981c63e98

SHA1
5cb0bf4fd429e3e51786764b4bccc77a4b2e9a50

SHA256
1fcd4b87f9a417e42ee71ef092f73c80fbe6c0e91dc4fe1b86615610de3d5061

SHA512
4abb60f53205b5a7ed5c2fe02b70bd42bbc16213e71457be32c9da76f495351772662d7f8b3db527289198c759e6b7067d4e07e70a3494849793987e06659353

Download Submit
C:\Users\Admin\AppData\Local\Temp\Moments

Filesize
86KB

MD5
c91c1ac87208df1f4bc9ad5cc020b571

SHA1
242ce7b15f04d255cd324b57baee5b092a1aad6c

SHA256
c388fd3a8006f6002bf5f0606f28c3b1aec52cc5adead7e7113cf968a685748d

SHA512
a0e730f7de889b6d987807b8ad34fcced94048e873687b3a52a74ea9f613ce227e05cb7392dc766a1984afb6d77f05da5c27e95c2c4bbe630a197252a7e33d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Purchased

Filesize
109KB

MD5
c8b72511514176b98f88cb9b810e8734

SHA1
ef74755915229e17ef8be063ae79eb248abf95b1

SHA256
cb0706339f95cfbee2206e09e9a387a128c4e1385130a36ae6ecce1b1a05e48f

SHA512
e52e7ce121aa6bd92f77d20c3d9fc2a7de4a8601582770212f70b98b657aabd2007323dc2034a8121a71b14a8f4968ba735d0f8fe0fdddef332e34eecd818b79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Quality.cda

Filesize
477KB

MD5
479683196e67c0a98d79201de707b1a2

SHA1
2ec214394469fac9398c74c885384a1fcea91487

SHA256
6b301dddc4fbc8a032299e2ee008ad0ac277e3d3de2821265c3765abc3dc52f1

SHA512
44ee95c7cfdfe7bdbdaa5da9ce645e6b028868194e9cfd26017002f5c59b3f4786d7455c69bcdeda21890360626cda0d9457b9f97437a28c4c55913f158c1131

Download Submit
C:\Users\Admin\AppData\Local\Temp\They

Filesize
77KB

MD5
0787048effd905eac0720fcff54f4e39

SHA1
f50d87da025e6a7dc3c1521f3142455a45372b63

SHA256
36ca66c6b0a8d60a9dc9cad9ada4577da1d52963982f2a3c4f39fba1a3c8a06f

SHA512
88e215ce3502b3d4d46a3099bce6c723a2092ce7774e11c754223ec1f4e7c9bec5eb914b62fe6e5073d9a8dc0521b4d48a9df643733f34be353e3778d4d74ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tourist.cda

Filesize
94KB

MD5
8d4baa550a8e4b3943d7990961be56df

SHA1
a19e5ea61e8c63fc5673787bb00cd2bf17490f84

SHA256
e4a4d8a6051597941bab63ac4a2d83501978436d9826496760d9841d46e031b0

SHA512
6a354adff672dad0c64135d896068ee2406d3721b72e5b935ce9f4ca7b8e089ed5737cad24d76c5a1804fd41a561e5cb5276c13faab48f602e32eb2fad03f56b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zum.cda

Filesize
41KB

MD5
99ce6bbc27c6d10d30dfe38c9cfc9baf

SHA1
5f2198f49eefcbc78056e03cfe3ff7c1fd0f5f99

SHA256
a1cb3293acf7dd2f9f47644c7b51d1caef34c328ab9debb86b8e22b4f361afe2

SHA512
ccb080846dda9130a44319e7872d92db4a4a80dcc0a110947602047fb49b6ac54d53627bc6756c4db025ecde6f73ded16733f970022dae4678d79028570e9455

Download Submit
C:\Users\Admin\AppData\Local\Temp\candles.cda

Filesize
17KB

MD5
67d288ddfbd64288ee836f85c79bbe3e

SHA1
a4ea361ddefa78271ace60f696a7e7bc06701d73

SHA256
13e15a5cdcc7f7d1d14ff5cd16301affa73806bbc853328944fa5d8cacfd12d9

SHA512
294c8c87ed3ee4b07e98a94e9499333a223c635533d6a9db652bbc9460faf2d6471a80f17ff284eecd59390752f988ff81509739d80b9259e23f95a1f77b8b4f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
e0132c7d79a0049f54264b128f091e40

SHA1
3bacd8daedb397f7a25f431aaf14e36ab86f895f

SHA256
8bd12bb5f0906428a18e9f206a46d47584a6e73998e6b30725d18b6e58ef33c2

SHA512
7d7e43453aaf826005961ec7cecaa8645a59157e71566d5b5a4167519d2b26c08c553743df975ac5c60f7fa561830c0a5d2103473c1fa4c369f2aca0d635dfb0

Download Submit
C:\Users\Admin\Downloads\abd9530b-243c-41d8-8dc8-f12be5e9f6f8.tmp

Filesize
42.7MB

MD5
715c065ba5ea6fc333c47748013f45fa

SHA1
b2d25c0a758f1300df255e4ce71a70321b93e855

SHA256
751a27292739619afd3e4808a837d9f945386bda222f418f879be450e1017a95

SHA512
3c429804254180cc956bc931ab4b68ad56ae038ed5da89761a34959017cc7d1219e60ddfecfc4b680ca942b502e281f9e12a87d4bde763dd5f99e662ce76f84b

Download Submit
memory/880-810-0x0000000075670000-0x0000000075885000-memory.dmp

Filesize
2.1MB

Download
memory/880-808-0x00007FF86AFB0000-0x00007FF86B1A5000-memory.dmp

Filesize
2.0MB

Download
memory/880-807-0x0000000001480000-0x0000000001880000-memory.dmp

Filesize
4.0MB

Download
memory/880-805-0x0000000000EF0000-0x0000000000EFA000-memory.dmp

Filesize
40KB

Download
memory/4504-793-0x0000000003F30000-0x0000000003FB1000-memory.dmp

Filesize
516KB

Download
memory/4504-800-0x0000000003FC0000-0x00000000043C0000-memory.dmp

Filesize
4.0MB

Download
memory/4504-801-0x0000000003FC0000-0x00000000043C0000-memory.dmp

Filesize
4.0MB

Download
memory/4504-802-0x00007FF86AFB0000-0x00007FF86B1A5000-memory.dmp

Filesize
2.0MB

Download
memory/4504-804-0x0000000075670000-0x0000000075885000-memory.dmp

Filesize
2.1MB

Download
memory/4504-797-0x0000000003F30000-0x0000000003FB1000-memory.dmp

Filesize
516KB

Download
memory/4504-799-0x0000000003F30000-0x0000000003FB1000-memory.dmp

Filesize
516KB

Download
memory/4504-798-0x0000000003F30000-0x0000000003FB1000-memory.dmp

Filesize
516KB

Download
memory/4504-795-0x0000000003F30000-0x0000000003FB1000-memory.dmp

Filesize
516KB

Download
memory/4504-794-0x0000000003F30000-0x0000000003FB1000-memory.dmp

Filesize
516KB

Download