hxxps://cdn[.]discordapp[.]com/attachments/1227683258238631987/1233119928329048134/stub[.]pyw?ex=662c98ad&is=662b472d&hm=7f497b21c12c809951e53223271aba5ba2223afa51d3d564f88e9e0a8a9d29c6&

Analysis

max time kernel
36s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20240412-fr
resource tags

arch:x64arch:x86image:win10v2004-20240412-frlocale:fr-fros:windows10-2004-x64systemwindows
submitted
26-04-2024 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1227683258238631987/1233119928329048134/stub.pyw?ex=662c98ad&is=662b472d&hm=7f497b21c12c809951e53223271aba5ba2223afa51d3d564f88e9e0a8a9d29c6&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355664440-2199602304-1223909400-1000\{DEB25397-5BF4-42A9-AEFD-122417B077A5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
4964	msedge.exe
4964	msedge.exe
3508	identity_helper.exe
3508	identity_helper.exe
5792	msedge.exe
5792	msedge.exe
5856	msedge.exe
5856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3184	4964	msedge.exe	86
PID 4964 wrote to memory of 3184	4964	msedge.exe	86
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 3564	4964	msedge.exe	87
PID 4964 wrote to memory of 2816	4964	msedge.exe	88
PID 4964 wrote to memory of 2816	4964	msedge.exe	88
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89
PID 4964 wrote to memory of 4460	4964	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1227683258238631987/1233119928329048134/stub.pyw?ex=662c98ad&is=662b472d&hm=7f497b21c12c809951e53223271aba5ba2223afa51d3d564f88e9e0a8a9d29c6&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1a2146f8,0x7ffd1a214708,0x7ffd1a214718
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --service-sandbox-type=collections --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --service-sandbox-type=audio --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --service-sandbox-type=video_capture --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10100491071801608166,17879116939601162022,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:5784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b48ff7be10f7ea621178a8f62c3584e

SHA1
f1726e0ffe479a4d5949c89e9f62ec42506875a8

SHA256
62b97b05a42ccdbef53d2f40080cd3e485e3af65a34cbf0570e62ab158e07e89

SHA512
a0a3e3e69f1b103ac4077ece457f91fe3c5903034ac04761756bb4fbe65240e99dfe132351546d42024f8409099e9df293693392f09f47194b3a38ae2e8f1e38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b99aa3fa7a84a89a0add3e3e232b79c

SHA1
fcb3f886d305d91adebc45f7aa8ac22e2645eef8

SHA256
b4b4fbefffdef13e39322a245f2e39bebc4f277879bce574af7feda6d7cb3bd6

SHA512
8c82318fecf77a48eca4f8e3246d2d1d279262e94e49057ace32eaa5ade63588df5499e18fb5e5a38e59fc9aaee89a3766ea4100b4fa86840a4598c98a1d695b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c18432d868f2b9865924f0ebac788b9

SHA1
ee17daa705bca70e64f4d821eca64f35d0c0a88b

SHA256
32e28fb47a9441902858d9b05dacfd24590d27a3107d2bf9fa82f38163bc85d5

SHA512
1fc22487ebe3eec9bf5c48f7e97b5815c4a72570b7e65fadbbf32c51cbd0768269e9cf9e9abc49b79777567a7265275f7c413094fe16957a5bab14f9ee3aa3d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2ada4ff-827d-459d-aba2-4edbc324e14e.tmp

Filesize
5KB

MD5
e5e8f8397278a740875c263e64d4908a

SHA1
6abc80951171ed133428def57e45af07748325b7

SHA256
ab1638a1ab9e7cb53b4b6f70fe3b5efe4d765b73fa1eec28e6f7e3c079152930

SHA512
0ed58ac0db6027213365498698c0c7707272ef7bb820ca201c9d65da02bb6de1c77491b38f0c5944fb21c9350ef779224c5d7eede88c28e987ba096fb0ca66c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
1872f635a9683dd6488d395b8d7177a3

SHA1
983ba11f89007c875a65255ef8767a0b7f265f5a

SHA256
0718500f8102b06c996a87ce227fadc1bef44494c3ed3c9134482675626c24d7

SHA512
b2bbbd68c3f3de33630516ed19463630a71bbadef5302c23a9f1891616c0878fa2c8e3349301d924271b502c765e8bfabda4103d16793b5696793264b8ac06ab

Download Submit
C:\Users\Admin\Downloads\stub.pyw

Filesize
281KB

MD5
deeafbf6ffe238f460dcdd20c409916c

SHA1
29b173c9e07d2ede050bf58fef70e1c9d9a75db3

SHA256
73a7e80cbb8f5b690fb7b858f7f482c917169eb86a3d027c952e636b6443e12f

SHA512
d3764cc44365a797b2dc31957456341f1f2d53f17eb76bba8e235325582911db6d83dc4c4bfd96f32535d99b066362931dc9ce086751a1b6e258c9f27eb27354

Download Submit