20807c02a31d8abd663beddcede18c65e89077a7661ad2e1552ff61aecc5efe2

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stand.Launchpad.exe
Size

72KB
MD5

9b86bb89406cdc59a1eb586d51d659bd
SHA1

3c4d6fdd1ec4e41ff303042cc0f00dbc8f7004e6
SHA256

20807c02a31d8abd663beddcede18c65e89077a7661ad2e1552ff61aecc5efe2
SHA512

892681337ad5d133470b23263aa557fe8f32d9c40f77a0bb574e5a47c935c806de0105b41ed2a8026392a4c70f44419b1ad3d3782803ccf8ee1169df8b81b5a5
SSDEEP

768:DOPg2CdwbmyCLIizV9iKfyyu8fo0Zrgk64eeeDoc5tul5scYhb:C42FKfLfVo0Zrg8VwSl5scmb

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 50167.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3112	Stand.Launchpad.exe
3768	msedge.exe
3768	msedge.exe
1920	msedge.exe
1920	msedge.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
2664	identity_helper.exe
2664	identity_helper.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe
3112	Stand.Launchpad.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3112	Stand.Launchpad.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 1920	3112	Stand.Launchpad.exe	87
PID 3112 wrote to memory of 1920	3112	Stand.Launchpad.exe	87
PID 1920 wrote to memory of 3828	1920	msedge.exe	88
PID 1920 wrote to memory of 3828	1920	msedge.exe	88
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 4908	1920	msedge.exe	89
PID 1920 wrote to memory of 3768	1920	msedge.exe	90
PID 1920 wrote to memory of 3768	1920	msedge.exe	90
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91
PID 1920 wrote to memory of 4552	1920	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe
"C:\Users\Admin\AppData\Local\Temp\Stand.Launchpad.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://stand.gg/launchpad_update
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdad846f8,0x7ffcdad84708,0x7ffcdad84718
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
    3⤵
    PID:4552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:2784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2996 /prefetch:1
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    PID:32
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:3912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
    3⤵
    PID:3816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6244 /prefetch:8
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16194849435358039933,1645003889536248395,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3152 /prefetch:2
    3⤵
    PID:680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
331B

MD5
ce80d518fd2b81bf53343e1b92c47b9c

SHA1
ca306e12129e173db0aae29af766c1468c681ce0

SHA256
a46cd6cbcdee438987431194cb011c3fbc26d8abf54f9f28f7aada9e62608e1b

SHA512
b5973e0fa27c95a62cf64de7cb9fb1df89e681737d7c513d7f0415fe749e16e20aeb814f97d3c6bebc63f172811b1f037790d77e866413b9a33873859ced0b26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21f5193f78790dd8559f5e5c9d1fdae5

SHA1
416dc9d2aa9f560033b96664010851ccdfbb9a76

SHA256
d5427f2e589da25cb906ed7f5236f0f6839777ae403de447c33f378d94a5b3fd

SHA512
df00060657ed7561404ab527c93f1ef6601936b407c0f07d7ea5982ce277dfd5a462ce1201688fe1c546f8da2146c44c28106e5aa8c3194f50a0ab3044cd68c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7e78149048bed0a9fc1c546eee06c8a

SHA1
6bcc6f607c72ced80e2d668ee9b2617532028975

SHA256
313d4c32dc6e6831548ac5e713f58560ed9694ca19228bbb9449a8409416e88b

SHA512
a24f25aa00aa97819eaf6a7e07d1c5d55d389ceacf9f74abe5472576b670c82175e45b7b021693d0e0af7906c6b91e3f8fb65d271cad5f69ace9fe081bf4ea44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4cbd8cf0a4df799da7b7b9cc02456cf6

SHA1
5f2685810ac17ab25e2914c169d0968cecda7292

SHA256
a4be89ad9c2da919c1997dadd7d6d3e16172dcfb245b2433ecafe1c0920afe39

SHA512
9a42e987c05e1b0486d6a556efc8da387cbebdf832d6adda36ee61897a5f8211dd2b48164ea818cbed87cb862a2e082ee5088b19012d8fc69714a22309b9b1cc

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 50167.crdownload

Filesize
77KB

MD5
856d627432e5e27a25e73c5fa602e73a

SHA1
fe1ea681e4837356376de7a32ca04a1fac1422e6

SHA256
2ca1de126855935f8522a5168e69a02226af9cd7595dacd920a242ef4f9afadd

SHA512
6ac1ea393496cede1337183528c435d440f8a4c4784ccb87e552f76ed8963f3892608c8f2b9bf350ac54af05fb26f068126ec440fbae543c8fb65b160f71539e

Download Submit
memory/3112-6-0x00007FFCCB730000-0x00007FFCCC1F1000-memory.dmp

Filesize
10.8MB

Download
memory/3112-5-0x00007FFCCB730000-0x00007FFCCC1F1000-memory.dmp

Filesize
10.8MB

Download
memory/3112-61-0x00000226E8CA0000-0x00000226E8E49000-memory.dmp

Filesize
1.7MB

Download
memory/3112-0-0x00007FFCCB733000-0x00007FFCCB735000-memory.dmp

Filesize
8KB

Download
memory/3112-2-0x00007FFCCB730000-0x00007FFCCC1F1000-memory.dmp

Filesize
10.8MB

Download
memory/3112-83-0x00007FFCCB733000-0x00007FFCCB735000-memory.dmp

Filesize
8KB

Download
memory/3112-85-0x00007FFCCB730000-0x00007FFCCC1F1000-memory.dmp

Filesize
10.8MB

Download
memory/3112-86-0x00007FFCCB730000-0x00007FFCCC1F1000-memory.dmp

Filesize
10.8MB

Download
memory/3112-87-0x00007FFCCB730000-0x00007FFCCC1F1000-memory.dmp

Filesize
10.8MB

Download
memory/3112-1-0x00000226CE610000-0x00000226CE624000-memory.dmp

Filesize
80KB

Download