eabc658deece003f4e76ef76fd0932a0a2d91e63725bb11daf07dc7052689b76

Analysis

max time kernel
132s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2023 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
Size

1.6MB
MD5

bcacc9b5f549ea9f84b329bb2fdf9293
SHA1

e5e6b61d29a99deb53d69ef72e1153bbf0beeb55
SHA256

eabc658deece003f4e76ef76fd0932a0a2d91e63725bb11daf07dc7052689b76
SHA512

86a385a22595129c3059c834a175c303b722f197a59a12bb96a96d01998ca0e8eff5a27552f4921745b7e015b98b4ad46b277099927af89249ce79b22b706483
SSDEEP

24576:2inUIrP+Zeb+NKgNqRB+uCny6Dorar3QrLamx4wlKDSVXT5Xzwya:2iZGXN3IB+Tny6cGlwlfXT5Xzw1

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\0a26159a-6094-402f-a546-74fecc6d37a6.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230514233918.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
Token: SeDebugPrivilege	3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 1760	3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe	92
PID 3592 wrote to memory of 1760	3592	Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe	92
PID 1760 wrote to memory of 3332	1760	msedge.exe	93
PID 1760 wrote to memory of 3332	1760	msedge.exe	93
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 2888	1760	msedge.exe	94
PID 1760 wrote to memory of 4808	1760	msedge.exe	95
PID 1760 wrote to memory of 4808	1760	msedge.exe	95
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96
PID 1760 wrote to memory of 1904	1760	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe
"C:\Users\Admin\AppData\Local\Temp\Resident Evil 4 v1.0-v20230424 Plus 36 Trainer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://flingtrainer.com/tag/resident-evil-4
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcec2b46f8,0x7ffcec2b4708,0x7ffcec2b4718
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:2888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
    3⤵
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6149b5460,0x7ff6149b5470,0x7ff6149b5480
      4⤵
      PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4262183522087927926,9604034942010778431,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
72554d384c3b2c0fa7e0fe27f7f8cd7e

SHA1
9f17d54a3d45886bf306d1ad05f61b016a802061

SHA256
c4f6025a08b2f039b3965ea84d5d45b7fb5f8cecd8d478bc1d55e831eade70ee

SHA512
dac83acf3018ecc2f2d0a12693f13c534eb9d96ae89b3852ba24b5201fd822172ea7feae5f01c078c197ccf56dd45f0f43a79db97ea2587d0fa0f389ad7a2e5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
cfbc16e33dcbef6f773f0f79af528f45

SHA1
ecb8d5e8107bc671dd57fb2a137c00bffa419f1f

SHA256
f0937890fb1053069baac97b7992c6d22cb74cae20317fc05d51070d96950ffa

SHA512
59ac2ead1eb84edffb06867850beb1e63f72c5b5415abd2fd4e7c2a1922c368f612d2a0288c00e32d5da47c4a77968ffbe72660a8d1f577f44fb20df9c11a4af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
b18f10d32d237323efc457870ef12e9f

SHA1
f67d3bc008faba349cda9164a8d60e79a425221a

SHA256
e1bb1a01aec7bc41d7a0a4fca28f8ef4413c60dfd4a839e5faf41d662272a65d

SHA512
765fa9838dc201ae3071804622408bbef3f3792d3ae912aff50d4316a65bcdcbf28459cce4c2bf55455f8211a80dfb12858d6612eaae5741f8f5bc345b6519b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
437fc3ab366adb766ea1ba168acede1a

SHA1
42d5c9c32c724811d40fc6ad7b7c4722edd73cd4

SHA256
1133b28e26f46766c346a4b355f55cabb7df6bd8c278debf9ce7eb65aba2208b

SHA512
b042c5335dc8f7ff097c8917266f314a10cc86bf7da6cfa869085e6c0466302ab183517763824dee8003544dcdef6c08b4fd9c8f191412303c365fe15b7e66b6

Download Submit
C:\Users\Admin\AppData\Local\FLiNGTrainer\TrainerSettings.ini

Filesize
37B

MD5
a733986b23235e9df2ed8652044f4718

SHA1
a6b37ab6584096eee4e0bb79013773eb752bfe83

SHA256
e34c9e06cdd656e5b901c1eedd6d28aa595ceebd80e3c585218980fbd5a9c473

SHA512
635f58eed8f3af8e3b167b9b7825589e17f2aa638449961a11c4c54538c8d262fca7a35001dc3bd1a86aabe7030ddd03e66757aa6b3882ae7c8f99c8aa3389c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cd4f5fe0fc0ab6b6df866b9bfb9dd762

SHA1
a6aaed363cd5a7b6910e9b3296c0093b0ac94759

SHA256
3b803b53dbd3d592848fc66e5715f39f6bc02cbc95fb2452cd5822d98c6b8f81

SHA512
7072630ec28cf6a8d5b072555234b5150c1e952138e5cdc29435a6242fda4b4217b81fb57acae927d2b908fa06f36414cb3fab35110d63107141263e3bba9676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1d40312629d09d2420e992fdb8a78c1c

SHA1
903950d5ba9d64ec21c9f51264272ca8dfae9540

SHA256
1e7c6aa575c3ec46cd1fdf6df51063113d277012ed28f5f6b37aea95cd3a64ac

SHA512
a7073247ae95e451ed32ceeae91c6638192c15eaad718875c1272eff51c0564016d9f84690543f27df509a7d579de329d101fbf82fed7cbeb27af57393de24ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
162KB

MD5
475f3b2f4b6829f089f959d8291c69ab

SHA1
10cfe4b0bad5e7fc4c1bd4c4f79f9cc32ed93c99

SHA256
4f40a7d3b7ddf8e77c9b9556b37cdbc062bda1e20757b4c709adcd3ee624b219

SHA512
fb2b2fb4b86dac393e35c42e66e327af699fa1c6baefdeb4ce9f95298990faed0ad556475d16ba6ad31868412f6179d996cff7c15329f4ef92778be592e9d712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ed4c2248750d47befa0ddf5c46bccf0e

SHA1
2f1f3e0c19507cc516fb8dda93756791652213a5

SHA256
e5cf27dde98d93f5bacfa7c194ea6be7ee34eac2bb4318de4e35dc388333b92d

SHA512
85e11295f92f0b40eacc104651adc4174827e690e579ff15dc66645602da197dbe0fb6941f9b8a8651fafe74c73a04117f11ff62b24b1c1f22d446f9a26e65a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
1a450187ca2f1f90b1bb17ad7dd147b6

SHA1
3019b8c77c4e5f457a70e377e89e92faac7f0a98

SHA256
8df9efb8fd7f25549f5478b7cf8c75d832a934045996b7418f0e769f0b076bfc

SHA512
6f952ac8a7312045dc0e9353ea53019a92ec86145151abbf82f628b6fab3a9b4b0b7f36d075161b54ae8c99e19a69e6e8a2003ee320364a66a85bab14a123b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
333454bda01ba45f66e1a4360a29a678

SHA1
746a9f7f05008fbb7b93823bb6921a8e5ae4efad

SHA256
9dda7af758e6f090a23008206fe3cd0f2ccf56488cc957dcf3584a6d5f0089d8

SHA512
35d35bfd59e06002dbd2f1457ba874b0e88bc0d891910ac5bd1d5212fb93a2d877bbbcd46481fc30fee671fc80615c4c188ac796b9af8ac01bcaa1d8cf6ae42d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
91040ecebb8e5d4355ae1354da24af86

SHA1
e78a051e094bda104170b72391cfcb0f7b463645

SHA256
7a1fb2aaa9c98687d0cbb8160f4f2656031774a86408f6cfe07149a410b1ac20

SHA512
69c3b253c221490832137529d6bb3ebed617394a06352d808d2f5ee5813f0564aa9d6e4fc50e46af360ceceb2a3244151c55fe2e0f86b26f7206a26681099664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
fd83df544eb13d9fc060fcb15868f3c9

SHA1
6cf9bab2e858f48b129f6a0e780fb3e7ea787779

SHA256
71fc5adb402e998f96a621a29a2d372e624b187a2d93b23f9b951bef67de7573

SHA512
b1816db8e4a20845514f2b044a41f61fe0b9ee41ea6113f1a0668155f2d2c56efc9f6505a0e216e44a94f82025717bc1daeaab7749d1af374718c6a5db3613e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c44421d3cb3f2b6792b7dae2b1766031

SHA1
39bcb205307f979c499a235b2d56322af4809838

SHA256
f2fb68dfcb28c807d6e4e5a3b0051e9dd6f551bb7e2054acad02c144382f53d9

SHA512
5d8aa27591a6dc2936a6b0b2b642ed9573a69210e879c2fa0f2fdcceb9ee2d86fa7b86200c6455be8a2e1e5b8b262948524ba1e967bc15383abfe3096f61415a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c7fae479ce85d9765ad9a3a91ec2d4d

SHA1
4af3c28886f28cb82f582116c9059c232b766f3e

SHA256
c6d711464f46e537ebfd1fb236b82f085cdae6de033da26a35adcb2bcc56ddfb

SHA512
8021329455c6d56d637c894ad4150838aa2ecd5fc6c9651ae4b1a3bc0c263267fac65fc61ac2ec0fb8e5b09ab559324425c31e24b59ab0f3148ca81d4b0dcf90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1e79203d0f70092bf25058099947d5c6

SHA1
20d5e2bd3a2ef807207bc3981bd5494c34839c0e

SHA256
decca6fa6de1f0dcc2b46a7c45e62d1754fda43b509d92393c628d56930851a6

SHA512
b06c5cb26083e2ef7a407be262f37d83d9fee4788e30a94ce258639f7c1fb2ccb4e37ca9b77e4fb30c0fa0a9e80f94a5b9719efd2499c87deafc87d260eb0568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1463bf2a54e759c40d9ad64228bf7bec

SHA1
2286d0ac3cfa9f9ca6c0df60699af7c49008a41f

SHA256
9b4fd2eea856352d8fff054b51ea5d6141a540ca253a2e4dc28839bc92cbf4df

SHA512
33e0c223b45acac2622790dda4b59a98344a89094c41ffdb2531d7f1c0db86a0ea4f1885fea7c696816aa4ceab46de6837cc081cd8e63e3419d9fcb8c5a0eb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
41030666ef123b714e8540ed37d0f5d7

SHA1
f927694bb6e95df745550bf939765d8c4114c26b

SHA256
adc6beddcf04664d1301e12cb7d7bd93aa73b955e24ceca9b01a147410ba726d

SHA512
e7bff93bb5e02b5a562d6b081e5a5ea7473b4e459eb12f45af9b1bfe3f8f8e1a9eedcfc314f8543e49b92069067e5ce7e7673716967062ae79cba1a73f300d83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bc6ec36ebafbfba03a3f0d85954d7be6

SHA1
9b2b66ffbee538c01871e4dd160bdb1116d68d66

SHA256
8e8ff537b25e85ff7f50db7417fa5b63e4d96c54f05bda926880538f27347761

SHA512
486098ac769770c3cda75613837b32faf383a25ccd689859c9094592a4459556952edcfdef606f41ecc07edf72f29ee42ed34ec8c529f9608ed0cfe5c90081cf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
fe970a61a83588570c1913a79bc7e7ac

SHA1
d57efc6b197ca294f5c4ba4c4c940f457f431427

SHA256
a471fe27162867fcdedb0e25a0377cb9c7cdd00bd2e497c953a36941577f9714

SHA512
43b03c39fe9c25da07f67bd462d70d224634af8377adf395d8d1c9d3823f498e3958ef48024ed41da315aad474a2345d21ee5221154b3ce53082dd9b87e25b14

Download Submit
memory/3592-159-0x000002003DBC0000-0x000002003DBD0000-memory.dmp

Filesize
64KB

Download
memory/3592-143-0x0000020042C00000-0x0000020042C38000-memory.dmp

Filesize
224KB

Download
memory/3592-161-0x000002003DBC0000-0x000002003DBD0000-memory.dmp

Filesize
64KB

Download
memory/3592-135-0x0000020025130000-0x0000020025164000-memory.dmp

Filesize
208KB

Download
memory/3592-158-0x000002003DBC0000-0x000002003DBD0000-memory.dmp

Filesize
64KB

Download
memory/3592-148-0x000002003DBC0000-0x000002003DBD0000-memory.dmp

Filesize
64KB

Download
memory/3592-144-0x0000020042BD0000-0x0000020042BDE000-memory.dmp

Filesize
56KB

Download
memory/3592-160-0x000002003DBC0000-0x000002003DBD0000-memory.dmp

Filesize
64KB

Download
memory/3592-142-0x0000020042B80000-0x0000020042B88000-memory.dmp

Filesize
32KB

Download
memory/3592-162-0x000002003DBC0000-0x000002003DBD0000-memory.dmp

Filesize
64KB

Download
memory/3592-141-0x000002003DBC0000-0x000002003DBD0000-memory.dmp

Filesize
64KB

Download
memory/3592-140-0x000002003DBC0000-0x000002003DBD0000-memory.dmp

Filesize
64KB

Download
memory/3592-139-0x000002003DBC0000-0x000002003DBD0000-memory.dmp

Filesize
64KB

Download
memory/3592-138-0x000002003DBC0000-0x000002003DBD0000-memory.dmp

Filesize
64KB

Download