05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 09:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SKlauncher-3.2.exe
Size

1.6MB
MD5

b63468dd118dfbca5ef7967ba344e0e3
SHA1

2ba4f0df5f3bd284bf2a89aba320e4440d8b8355
SHA256

05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf
SHA512

007ecb7445dc0c01a802b5a2c91313aae59f9dc96e27455dd85e7a92a4e649d683fbc2ada5f48925d9ab3b4fdaea20aa89eeb442fde079902aecb5ca3454a548
SSDEEP

49152:HIBc3n9dRvwVlzhFAQ/ggUTPQjYEiim7V:oBaO/FAqMQjYEXm

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2556	SKlauncher-3.2.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5044	icacls.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
5016	msedge.exe
5016	msedge.exe
4540	identity_helper.exe
4540	identity_helper.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2556	SKlauncher-3.2.exe
2556	SKlauncher-3.2.exe
2556	SKlauncher-3.2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2720	2556	SKlauncher-3.2.exe	81
PID 2556 wrote to memory of 2720	2556	SKlauncher-3.2.exe	81
PID 2720 wrote to memory of 5044	2720	java.exe	84
PID 2720 wrote to memory of 5044	2720	java.exe	84
PID 2556 wrote to memory of 668	2556	SKlauncher-3.2.exe	86
PID 2556 wrote to memory of 668	2556	SKlauncher-3.2.exe	86
PID 2556 wrote to memory of 4768	2556	SKlauncher-3.2.exe	94
PID 2556 wrote to memory of 4768	2556	SKlauncher-3.2.exe	94
PID 2556 wrote to memory of 4904	2556	SKlauncher-3.2.exe	99
PID 2556 wrote to memory of 4904	2556	SKlauncher-3.2.exe	99
PID 4904 wrote to memory of 5016	4904	rundll32.exe	100
PID 4904 wrote to memory of 5016	4904	rundll32.exe	100
PID 5016 wrote to memory of 3088	5016	msedge.exe	101
PID 5016 wrote to memory of 3088	5016	msedge.exe	101
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 4816	5016	msedge.exe	102
PID 5016 wrote to memory of 3836	5016	msedge.exe	103
PID 5016 wrote to memory of 3836	5016	msedge.exe	103
PID 5016 wrote to memory of 2168	5016	msedge.exe	104
PID 5016 wrote to memory of 2168	5016	msedge.exe	104
PID 5016 wrote to memory of 2168	5016	msedge.exe	104
PID 5016 wrote to memory of 2168	5016	msedge.exe	104
PID 5016 wrote to memory of 2168	5016	msedge.exe	104
PID 5016 wrote to memory of 2168	5016	msedge.exe	104
PID 5016 wrote to memory of 2168	5016	msedge.exe	104
PID 5016 wrote to memory of 2168	5016	msedge.exe	104

C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe
"C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- \??\c:\PROGRA~1\java\jre-1.8\bin\java.exe
  "c:\PROGRA~1\java\jre-1.8\bin\java.exe" -version
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:5044
- \??\c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe
  "c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe" -version
  2⤵
  PID:668
- C:\Windows\SYSTEM32\reg.exe
  reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
  2⤵
  PID:4768
- C:\Windows\SYSTEM32\rundll32.exe
  rundll32.exe url.dll,FileProtocolHandler https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?scope=XboxLive.signin%20offline_access&response_type=code&redirect_uri=http://localhost:26669/relogin&prompt=select_account&client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize?scope=XboxLive.signin%20offline_access&response_type=code&redirect_uri=http://localhost:26669/relogin&prompt=select_account&client_id=907a248d-3eb5-4d01-99d2-ff72d79c5eb1
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffbf1da46f8,0x7ffbf1da4708,0x7ffbf1da4718
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3435317205938930121,13383425471679364382,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
89b38f97eed60496f878eb06ad252895

SHA1
e2349f247252783e00cfbe5b3e0127f30b1e4d3a

SHA256
066f08e11402a9ef1f66889c51a210a0323a9b594e74af5b8f65706ea21b5ecc

SHA512
550718d6a29f3b98466bae8ae8b819036c3d7d0eed4a664a4738d774e8004fb9ade909bd494957a90f43c7657d5f7852872ce71cfce032249510cc1e235cad62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
1af2ffd6e141dcf0fa3bfe90574bb74b

SHA1
c80cea80afd35d1e67129c2d0b919373e8792fd4

SHA256
3ceccbe54e88eb89a4f53bd2496fdd677dd0488b0343734ba82e751944e45665

SHA512
3e07257e8efd4eaf8b8612772fb4fcd134b2a093c9553ee5bc34e6b96658a352fb37e04d7bdf1f371cbd1cef9b9334215f3e4be5972043a2f37ad97be313924b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
363B

MD5
73025cb0adc7e797436358dfa6bb9425

SHA1
6409567e882bf9d3df734cea9276a6885e0509ba

SHA256
67071c62dafe83222a4757032c95b4ecbadf34b870dccda8610bebc2a26319f9

SHA512
325f12028e9a8aa41d9dcf10747db7e709106ebc46c8dac489d7644c2360a87a327eb0e6276cfa77a3435021f86bfdd4cd58d6ba128ada94128904ea0e81ebd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4cb1a2c0407c7ca6acf32c5a465acc9d

SHA1
476f5ec307fb0d8a0d27e3ed2504604f19d52716

SHA256
9ef83699f565f66ec31ec7357dd437424cd8b3affef374fca339bb02718efc4a

SHA512
a696d16fc9a0a66c8846634d5cad4cc2ed1969b4f2987b19929fb79e01de05b0a19bdb2e04d98aba9fe897fed25736f66896d334c22d1109eb9fc9ae5138d779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98f1219c4c7a2b0c8d2e971a8b2aca2e

SHA1
2db88e3e875f7f6bc2b7e24bac9c4fe6e38c88e5

SHA256
cc91cba1e054ec43c8266adb153ba804d086db3a4ea7ef1e7b2ba155c7890b4c

SHA512
c39ffd861cc425065d7e1f8b9a0a729764a2bde1dfd8b40701112baade0f44041ec1f5317be30a6ca75541c9ae6dc5ce1044205cc0f047a48506b74aa08f748d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6cd5bb3b5b36b4b19656a1a994eeb53c

SHA1
7d0ad4d4409462a3bdb675eba96d8026d035c695

SHA256
60ed934bf737d717fb3054fe5ec0e5fcaa03e79bfc99f320d2b4073b7e275bb5

SHA512
a3ae9208d4a05d0cb6e1f18957cdb09808a40cc998d992051f4c28391ff8bb904ac14e9a0ff951d50759ebc63e5b636bb2477827ec0ef681b4930e243af6bc94

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF1079705190655080919.tmp

Filesize
397KB

MD5
fdb50e0d48cdcf775fa1ac0dc3c33bd4

SHA1
5c95e5d66572aeca303512ba41a8dde0cea92c80

SHA256
64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123

SHA512
20ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF2788910594401828546.tmp

Filesize
398KB

MD5
ff5fdc6f42c720a3ebd7b60f6d605888

SHA1
460c18ddf24846e3d8792d440fd9a750503aef1b

SHA256
1936d24cb0f4ce7006e08c6ef4243d2e42a7b45f2249f8fe54d92f76a317dfd1

SHA512
d3d333b1627d597c83a321a3daca38df63ea0f7cab716006935905b8170379ec2aab26cb7ffc7b539ca272cf7fb7937198aee6db3411077bedf3d2b920d078a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\+JXF8395776031419261717.tmp

Filesize
405KB

MD5
8f2869a84ad71f156a17bb66611ebe22

SHA1
0325b9b3992fa2fdc9c715730a33135696c68a39

SHA256
0cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1

SHA512
3d4315d591dcf7609c15b3e32bcc234659fcdbe4be24aef5dba4ad248ad42fd9ab082250244f99dc801ec21575b7400aace50a1e8834d5c33404e76a0caac834

Download Submit
C:\Users\Admin\AppData\Local\Temp\e4j3A2A.tmp_dir1717924601\SKlauncher-3.2.jar

Filesize
1.1MB

MD5
4d653e61ba01a521c56b9a70a9c9814e

SHA1
de855dc3dbc914b497b58da92e0c21fff660796d

SHA256
f7d3e01dcfc001cc80a988c518d4358955842d140054214d1367972c5c543350

SHA512
e6a7db6e2893b5b01dd0c84a230d88abf50da63ceb1af5754a2c4c1fbd307a799a74f3f368430d3beb33590cda2e0a3cf509fef11c4477b76e8d3c4a582b5def

Download Submit
C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4538597642900.dll

Filesize
22KB

MD5
dcd68a87b7e6edbcfde48150403b22eb

SHA1
28e4839a29725075772fccc39b44e194eb91e477

SHA256
ae3352b6ad6cffaae55f4387f9f5e79365ea17f8d5fb45ef11d21c3300a49a4c

SHA512
ac2a6bc0afcd08c56090536a937772edd54f35505c9a5837d9bc8e91c31edb6137cf5191986b3473e9e2f512950b4dbfe4088598bfd1faf47088124c70aeba71

Download Submit
C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar

Filesize
14.1MB

MD5
9b59fa715db2f9f8f6ed9e14f3768ed3

SHA1
9d46c5898c653fb1785e399b74f26633107d0bde

SHA256
fab6dede2f59dc4b7b6be032fbce1209a93aca02b7d6c126e3f1584148230146

SHA512
e9e84b056e0f1d8be544194a275ca61b5e6820dbbd701dec5aa75b804705ab33cb826314c0f6edd527cffa84de80062c559f9fb49c53b5bbfda9481bd138be5f

Download Submit
memory/668-20-0x000001D700000000-0x000001D700270000-memory.dmp

Filesize
2.4MB

Download
memory/668-30-0x000001D778330000-0x000001D778331000-memory.dmp

Filesize
4KB

Download
memory/668-31-0x000001D700000000-0x000001D700270000-memory.dmp

Filesize
2.4MB

Download
memory/2556-318-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-82-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-219-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-231-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-237-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-123-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-305-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-306-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-304-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-138-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-109-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-214-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-173-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-49-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-207-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-45-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-34-0x0000000002E60000-0x00000000030D0000-memory.dmp

Filesize
2.4MB

Download
memory/2556-186-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2556-847-0x0000000002E60000-0x00000000030D0000-memory.dmp

Filesize
2.4MB

Download
memory/2556-174-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/2720-5-0x000001E608CE0000-0x000001E608F50000-memory.dmp

Filesize
2.4MB

Download
memory/2720-16-0x000001E608CE0000-0x000001E608F50000-memory.dmp

Filesize
2.4MB

Download
memory/2720-15-0x000001E608CC0000-0x000001E608CC1000-memory.dmp

Filesize
4KB

Download