b555a19cc2468b660d5c4f4a4fcc763eed33b341dc4dc0e58129d0fa0ff4236d

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aecaca798a98f31a2166fe9ad8276db.exe
Size

49KB
MD5

8aecaca798a98f31a2166fe9ad8276db
SHA1

b8f83a598bab8d679d558f1150ebe797b061faec
SHA256

b555a19cc2468b660d5c4f4a4fcc763eed33b341dc4dc0e58129d0fa0ff4236d
SHA512

c2800d3fe80f97cf6d17d15a114824cf65aa40efe056055fec0d6e0b8304abf6b184b8c875ead736e7e54b4ebad461604159b1e03e061b7e17854e1524b26be6
SSDEEP

768:TNvsQ182vfpHd8vyAHTTAq4MJvwLXo1FXKWTqosNq7pYXv9f2E:TNvsQq2vfZd8vlH3p2WaWTqosNqdY92E

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1448	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	8aecaca798a98f31a2166fe9ad8276db.exe

Executes dropped EXE 1 IoCs

pid	Process
3116	Shockware.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GhostPlugin = "C:\\Windows\\Shockware.exe"	8aecaca798a98f31a2166fe9ad8276db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GhostPlugin = "C:\\Windows\\Shockware.exe"	Shockware.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
22	sites.google.com
73	sites.google.com
83	sites.google.com
14	sites.google.com

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Dkplugin.exe	Shockware.exe
File opened for modification	C:\Windows\Dkplugin.exe	Shockware.exe
File created	C:\Windows\Shockware.exe	8aecaca798a98f31a2166fe9ad8276db.exe
File opened for modification	C:\Windows\Shockware.exe	8aecaca798a98f31a2166fe9ad8276db.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6128	msedge.exe
6128	msedge.exe
3672	msedge.exe
3672	msedge.exe
3380	identity_helper.exe
3380	identity_helper.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 1448	4132	8aecaca798a98f31a2166fe9ad8276db.exe	85
PID 4132 wrote to memory of 1448	4132	8aecaca798a98f31a2166fe9ad8276db.exe	85
PID 4132 wrote to memory of 1448	4132	8aecaca798a98f31a2166fe9ad8276db.exe	85
PID 4132 wrote to memory of 3672	4132	8aecaca798a98f31a2166fe9ad8276db.exe	88
PID 4132 wrote to memory of 3672	4132	8aecaca798a98f31a2166fe9ad8276db.exe	88
PID 3672 wrote to memory of 3736	3672	msedge.exe	89
PID 3672 wrote to memory of 3736	3672	msedge.exe	89
PID 4132 wrote to memory of 3116	4132	8aecaca798a98f31a2166fe9ad8276db.exe	90
PID 4132 wrote to memory of 3116	4132	8aecaca798a98f31a2166fe9ad8276db.exe	90
PID 4132 wrote to memory of 3116	4132	8aecaca798a98f31a2166fe9ad8276db.exe	90
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6124	3672	msedge.exe	92
PID 3672 wrote to memory of 6128	3672	msedge.exe	91
PID 3672 wrote to memory of 6128	3672	msedge.exe	91
PID 3672 wrote to memory of 5284	3672	msedge.exe	93
PID 3672 wrote to memory of 5284	3672	msedge.exe	93
PID 3672 wrote to memory of 5284	3672	msedge.exe	93
PID 3672 wrote to memory of 5284	3672	msedge.exe	93
PID 3672 wrote to memory of 5284	3672	msedge.exe	93
PID 3672 wrote to memory of 5284	3672	msedge.exe	93
PID 3672 wrote to memory of 5284	3672	msedge.exe	93
PID 3672 wrote to memory of 5284	3672	msedge.exe	93
PID 3672 wrote to memory of 5284	3672	msedge.exe	93
PID 3672 wrote to memory of 5284	3672	msedge.exe	93
PID 3672 wrote to memory of 5284	3672	msedge.exe	93
PID 3672 wrote to memory of 5284	3672	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\8aecaca798a98f31a2166fe9ad8276db.exe
"C:\Users\Admin\AppData\Local\Temp\8aecaca798a98f31a2166fe9ad8276db.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram C:\Windows\Shockware.exe profile =all
  2⤵
  - Modifies Windows Firewall
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.utilitary.kit.net/img/lidy1.jpg
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0f2046f8,0x7ffa0f204708,0x7ffa0f204718
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:2480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:2396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
    3⤵
    PID:5584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:1
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
    3⤵
    PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,5301192588871301649,15229196129753918144,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4756 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2244
- C:\Windows\Shockware.exe
  "C:\Windows\Shockware.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  PID:3116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
970e4b0e2cbc529c3914e4173d9808bc

SHA1
552bbe2ca3e141d9e9d9c32e07721e3d46b318cf

SHA256
7a243c11635ca5015aa76dbe1e4a4c63c634bf22035a7cf417474c62d533204f

SHA512
2f9043ab3cbd73102b2ce5c7d8fe75f4976ffe0b8993214b676b1e47df62cf2f5152b8baabddbbff3c13a6f1d4c320aa3ad00d20cef2579bb5c537fe726b9042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
092dcd87de9394e82b133e2a6a18ed08

SHA1
8cc2c16451a0016159b0fe596afe5bf4d63c22bb

SHA256
fe5ad2433a70f4111195ed4ee0f5679e6794ed67197d1208a23d0530c088b6ab

SHA512
4ba771f6719dfc28abfe71448ba2315c1b1ec916a81e417af2107c826414c649546297f25f3b4ee8393fb6aa13171824e58a00c49e1262000f45dab51fa3d5b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dcae016445f3e3aa878ea9725101b454

SHA1
c32f1516dfbc80cab4cc2743184ad8e6424a8c7e

SHA256
a2c67d9234fdb667706841ca00a58a81006bf95a627f32f407f19992a08d8772

SHA512
f59136f5e3b5a04a3ace53280d055302cadf5ce12906ce5dfcc0cbe138e5a9cf4227912cc80ff95b1ed7f1f5ab14809c038ece0fe95cfc2365c854ab1c59a5c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7V1N9ZS9\index[2].htm

Filesize
225B

MD5
b7aade656bb1d4ff36f20133c7cbe882

SHA1
3b71a12ffd92360328ae3dd7019ed670d6586978

SHA256
d215646ee62eed771908c15774fb8694fa966bde95f62f710a3b8ab1c743cb8b

SHA512
ce3e44b9ead9a816fa0e4b2e129dcc15f23b71ac0c905d288bd9ed171c02b068f98159a6d536789f5c0c54082181d65bf16c4d71ec8b16c78305daece60c37a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8D1Z5HG5\index[1].htm

Filesize
190B

MD5
be358fa4a2a0a21d59aedd2029eb44e3

SHA1
ffed345b60df62abd3ac54294aec35aa7021f0f5

SHA256
0c6490a5b0e0343bced6b0aa6b55aa8a407cec8066670fc4a54e5603dd2d6ff2

SHA512
320301ebe0a5eeee4d3b207f7c7ffe5e4dfd20e296929c2f380d8d35208b0647cdb2db84d97f76ee463e3c25156649354ca74f5b9593dc1ab723baba585e83b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GG17NQDF\WebspaceNotFound[1].htm

Filesize
288B

MD5
ff42d3a9534638a76a831cf93dddd917

SHA1
c6cf8769a329c04d49cdca2a67c1faeb8e76a75c

SHA256
a73059b4c4f21e5867266c64e5a9baa7ae21671c3aee2ceac39b6d47416eb4ad

SHA512
4bd8a647fe876097bf35e64a3a2ecdf8e572fc2aba1df04d76af7c08f72e2988755c49d6b7d3b7eebebf7677c8aeada666c50d2012cb228df159f7ce814c57d8

Download Submit
C:\Windows\Dkplugin.exe

Filesize
181KB

MD5
4f1cfe8e5fa6e0dd9d25dfdba048d2b4

SHA1
552d330a03937c528dcb9aa586c45a73602fc455

SHA256
3ea48f2ce5f934ed05b5b8a19e00f37bc908fe2929496fe59b7693461a8beedb

SHA512
456643c8e836e1f63f2b7438d637442cc9ff74a97b083977047f3d0e371ea44a4b8e086648acaba86e25df9c6322ae207f1b3eea53521357e1b02a54ebc94c21

Download Submit
C:\Windows\Dkplugin.exe

Filesize
181KB

MD5
f308b5c508948b0e29bf1e694f7c00a7

SHA1
49ff3ea8665131b635c74ab4fdf727dd57358c93

SHA256
ebd0dcaaee9b65cd94a70212e160d4708f9ac5820bc24659cf288043cb66f18f

SHA512
7b2ff4efaceaa286882e1e518c1a5c808b32e8ee19dbf81c95383a4e7e0a2a04433552c39e4e3e58ea8def337aa14ba5911fb2352f6b36564b1ca12b19dea6d9

Download Submit
C:\Windows\Dkplugin.exe

Filesize
181KB

MD5
57b2c32f86e776178a53d21e502449c9

SHA1
7921f1fb21b9b196a99389cfddc1547e333e73f7

SHA256
7a6048bb26e08b113515656f0be80f0df897d28089ac11dfd40866d867d6ebb6

SHA512
393f70a94a52c7b8007404f6a8723743b8e7a27bbaded16bd33b661d21bc5ad7979fda81f8fb5d10935b79e169ff35d80d42be92bab19448ea257324a68be7a8

Download Submit
C:\Windows\Shockware.exe

Filesize
49KB

MD5
8aecaca798a98f31a2166fe9ad8276db

SHA1
b8f83a598bab8d679d558f1150ebe797b061faec

SHA256
b555a19cc2468b660d5c4f4a4fcc763eed33b341dc4dc0e58129d0fa0ff4236d

SHA512
c2800d3fe80f97cf6d17d15a114824cf65aa40efe056055fec0d6e0b8304abf6b184b8c875ead736e7e54b4ebad461604159b1e03e061b7e17854e1524b26be6

Download Submit
memory/3116-77-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3116-163-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3116-6-0x0000000000470000-0x0000000000472000-memory.dmp

Filesize
8KB

Download
memory/3116-197-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4132-127-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4132-76-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4132-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4132-1-0x0000000000500000-0x0000000000502000-memory.dmp

Filesize
8KB

Download