hxxps://cdn[.]discordapp[.]com/attachments/1022877139856535783/1246144433896820786/MesterMC[.]exe?ex=665b51f1&is=665a0071&hm=a5550b2faa1b769bee849a4ffdcca64405e9461686129584b147667a050d9247&

Resubmissions

31/05/2024, 16:58

240531-vgt89aef31 8

31/05/2024, 16:54

240531-veg6xaee61 8

Analysis

max time kernel
146s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
31/05/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1022877139856535783/1246144433896820786/MesterMC.exe?ex=665b51f1&is=665a0071&hm=a5550b2faa1b769bee849a4ffdcca64405e9461686129584b147667a050d9247&

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3316	MesterMC.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3908	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 619534.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MesterMC.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
2428	msedge.exe
2428	msedge.exe
1232	identity_helper.exe
1232	identity_helper.exe
2176	msedge.exe
2176	msedge.exe
2124	msedge.exe
2124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe
2428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 3896	2428	msedge.exe	78
PID 2428 wrote to memory of 3896	2428	msedge.exe	78
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 4888	2428	msedge.exe	79
PID 2428 wrote to memory of 1508	2428	msedge.exe	80
PID 2428 wrote to memory of 1508	2428	msedge.exe	80
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81
PID 2428 wrote to memory of 3428	2428	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1022877139856535783/1246144433896820786/MesterMC.exe?ex=665b51f1&is=665a0071&hm=a5550b2faa1b769bee849a4ffdcca64405e9461686129584b147667a050d9247&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcca413cb8,0x7ffcca413cc8,0x7ffcca413cd8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,12622316731359871858,6997413236647360651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Users\Admin\Downloads\MesterMC.exe
  "C:\Users\Admin\Downloads\MesterMC.exe"
  2⤵
  - Executes dropped EXE
  PID:3316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c java -version 2>java-version.txt
    3⤵
    PID:2420
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
      java -version
      4⤵
      PID:5012
    - - C:\Windows\system32\icacls.exe
        
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        5⤵
        Modifies file permissions
        
        PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
1c7e0f55e2974220cb16a102eb91687e

SHA1
3a4c5a916b67d95fa4be29d2d49edfa10d91b4c3

SHA256
6bb1814fa8b414a7b00d975a86962826425f49ce4fcd38065ab1633900576614

SHA512
daadb16a59c42a5693841499c71ff46e03a4ae50cfee10fa7240794eca3a3d3fd9a4e248d47a7d7e8c48a91a9f4acd35054dd2089502dd8690b55918b59c5a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a149e5c-569d-43de-9ac0-6c49ae6f2e01.tmp

Filesize
11KB

MD5
88faafbc14f1a369539e8bbbcb537b2c

SHA1
f774a5dee1c81345c9daf673acc543c2798cad70

SHA256
2516ee7461b256c42043bcec74c675993f888593efab3da90fc74e4c90d3bc27

SHA512
e52c5444c35dc1428c8fa1439cd01c0a832d4c9b85be45d9ecec32098255deeed9d6e3759c8069897c8cf0da1f6dcc59fd77f10599b8bd1b853f6789b7bbd468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d56e8f308a28ac4183257a7950ab5c89

SHA1
044969c58cef041a073c2d132fa66ccc1ee553fe

SHA256
0bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae

SHA512
fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8f2eb94e31cadfb6eb07e6bbe61ef7ae

SHA1
3f42b0d5a90408689e7f7941f8db72a67d5a2eab

SHA256
d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de

SHA512
9f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
37510534546efcc7fe6e6cb178155946

SHA1
eedf21872436f20db8bef05012d2ffc02754667f

SHA256
e34fd936279e5a37c99ff6ddb28f37b060f89ff48e2bde7754352548aa675b09

SHA512
7cbc4ef8f4f63c7c070f222788019076a8525c9f4d5e4c4bf1720514d3fddd8525d3a6abf7a7aa4ddc90a72ffccfde87f92de1cfdb4a1e054163f3bb206fa9f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
64e08f084ecbc923bc0ec001abef3828

SHA1
650caf6d738222c9609ebc2b2007321175e6814e

SHA256
8e1f6f0bc34cc672e638143e6181f6e568d75b28e4db788298a5688ecf8fbced

SHA512
c18a15a4354c26cf43a0bc9c6254807cb7e2511c16c9dde99638323c3f985d8452ceaaf11dd9a853d7561041a193694734d113c71db3a3e3575dbbb669c65be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
862acf4a922021ae0f81226e6dfebd5b

SHA1
225a92e068434c698112939d9a156d2d32d9974a

SHA256
4c292067494eb97c51dbf2a402aa1f9082c77b07c4309bcab7a5426972aa17c3

SHA512
c6ea4e56946bf3c3d6a147b654b6034d977be133646197c6a1c159ae8e52f4a61b8ce4457ff1e68c2100f08242fe46a03941dba113622d3f9e3826796d39a799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
edfdf5c855fd7c3549cfb06e08c0c1e9

SHA1
91711d5a53343d91d51da0ad7c2a2095b973ab15

SHA256
785f23b9193482f59ed114085e7e0494defdea75a64c51e67903a4255bf0784b

SHA512
852e6876baf176f1bd7c8a014cdb05f0af4d1b66642cb535e6b800b3acdc08ad3b202233cae9d01654a5a6ade14b15c868db94877a0b3dc38bf87e313c0a6cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c8d0c325bc0acc94dc2bc56b7196c217

SHA1
93414d1954b14d36d1aa9358b34f3282f60a7323

SHA256
93a037e1d9195c5c949b97282a381c75a0f2491df5969cf1b667df9bb417405e

SHA512
7cba7f92881f6800f5e2ab1959d51c7e4ff3f507f9bd17a1c22b0931064d8f5a4793a0de7a763b92b0284e596ec59ec877bdb28229db34e2c771ebae4969c5c5

Download Submit
C:\Users\Admin\Downloads\MesterMC.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 619534.crdownload

Filesize
622KB

MD5
ae87665288c23826dc42936c88b5c601

SHA1
3d1852603a86f3846cb056bd5ff908dbc1b68d09

SHA256
212f5b38d07976823d2ba1ce3acdb85c1bf2d46361e352af56c05f333d5c8694

SHA512
5e9868a7241264d6bf290a58e71ba360353c7adebfbfee597632928bc683555e0f90e29ae4c4927348f551401fc6047518e9240ca2fd6402cc427febf80d4d6f

Download Submit
C:\Users\Admin\Downloads\java-version.txt

Filesize
147B

MD5
faf2f8b188047379978915849af13d28

SHA1
42ecb6f269f3dc3183d3b72b4216010f106d3317

SHA256
4ebfda517657bcc9f2b2e3c3cd13e58e9adef320c0ca1a8ac9aee888d4e1ef8e

SHA512
85c3afedfda0aa63edab3b1c5ed7ef8b06e392d387ea3c16bd28c66a54f72c7cbdd14b8af9428168402313f8a4d203be7e5f8a6732d0d8d52d46fe3963ebde79

Download Submit
memory/3316-140-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/3316-141-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/5012-127-0x00000275CE5A0000-0x00000275CE5A1000-memory.dmp

Filesize
4KB

Download