hxxps://github[.]com/QwertyTheCoder/Minecraft-bedrock-cracked/releases/tag/v4069

Analysis

max time kernel
113s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/QwertyTheCoder/Minecraft-bedrock-cracked/releases/tag/v4069

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2764	powershell.exe
1600	powershell.exe
4420	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
5048	msedge.exe
5048	msedge.exe
1396	identity_helper.exe
1396	identity_helper.exe
3332	msedge.exe
3332	msedge.exe
2448	msedge.exe
2448	msedge.exe
2764	powershell.exe
2764	powershell.exe
2764	powershell.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe
4420	powershell.exe
4420	powershell.exe
4420	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2920	M Centers 4.0.exe
2360	M Centers 4.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 1972	5048	msedge.exe	82
PID 5048 wrote to memory of 1972	5048	msedge.exe	82
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 1956	5048	msedge.exe	83
PID 5048 wrote to memory of 4080	5048	msedge.exe	84
PID 5048 wrote to memory of 4080	5048	msedge.exe	84
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85
PID 5048 wrote to memory of 3448	5048	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/QwertyTheCoder/Minecraft-bedrock-cracked/releases/tag/v4069
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff896dd46f8,0x7ff896dd4708,0x7ff896dd4718
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1988,2450308732590029418,17293438046461218604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2116

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4516

C:\Users\Admin\Downloads\M.Centers.4.0.x64\M Centers 4.0.exe
"C:\Users\Admin\Downloads\M.Centers.4.0.x64\M Centers 4.0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\main\main_1.bat" "
1⤵
PID:2040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\Downloads\main\19041.1288' -DestinationPath 'C:\Users\Admin\Downloads\main\19041.1288.zip'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\main\main_2.bat" "
1⤵
PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'C:\Users\Admin\Downloads\main\expand.zip' -DestinationPath 'C:\ProgramData\MCenters\Methods\Dll\' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\main\main_2.bat" "
1⤵
PID:4004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'C:\Users\Admin\Downloads\main\expand.zip' -DestinationPath 'C:\ProgramData\MCenters\Methods\Dll\' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4420

C:\Users\Admin\Downloads\M.Centers.4.0.x64\M Centers 4.0.exe
"C:\Users\Admin\Downloads\M.Centers.4.0.x64\M Centers 4.0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
fe3aab3ae544a134b68e881b82b70169

SHA1
926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

SHA256
bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

SHA512
3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0699e64885bb67b7fca5c440c5297cc4

SHA1
17c0d7fa213873c2ccfbe8b66d9ea283359fccdf

SHA256
5633d06f7f2d76d453b788ce4365a969dec1799e7a68fad67cc6fd563d3b9187

SHA512
304f1ba39a2a65e79301477620df67cdd9e34161c2725d2888e394768c73c7ddb6d567d89a2ade34ee7066a238f3eabc93830d21c158f559a14be4bd54cad6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
30322550d9f9c54f345ea1c71f3b2e8f

SHA1
b5a3cff2995147279c2bbed7c03b2280ecb286e5

SHA256
4e7798d8476361378f8fbfb0442db63c7f6bf7e1830d50808bfdb8a58700d8f9

SHA512
261d1f5bc9c8a369f815eb846c252f54681f70862153bd49959411450870207b3ee240cc9016533c27401922527d561cc1ea7bb23708e4a257f071d010cf55ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0282fa19bf11cfd3d078998951a50c15

SHA1
26ef8f927ccf8a4b419bf83be072ebb54fbf8108

SHA256
ad8b30bef0375b7d8792c07aa92ea54475547c2058d1f2d87e0c35c46b4c6925

SHA512
7eae9edca4c86c67ccfbac9829a34d10a75e0a2c93784ce79291686d15ea21103ec6d863dd313647277227420e570b571c8b4e08d77895002b68dbdd45e2aee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d1f05df1295c0d16d36f9fc6e5a2ba04

SHA1
73132d7a6a583996894092e126300d61c0531e60

SHA256
c72680d7e31520c5fc530e63ec169b718e7cdfa1d8e5b6761f439b018f835c60

SHA512
bca924bf4117b16c5196d846d32b493957cc896091a1c47459f46f65b4d7e46a632d7a72b5dc39f919d46069f7d8e061b63d5f4d61705dcda8b6edf26ef2a720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
07213ec0399e3e5b37f236b76e065f56

SHA1
b3f33cb6d11a742e3a1d735f944d93f44f3786ed

SHA256
30829260197e189924e4b994476a7a4137a7a50dd8d4f4e635ffc67fdc52b7f4

SHA512
74e1243282ee23bb252eb80b2ca0d6ebd61bcba2759445bc9c6bb53082971d216f532d16f3a852de23bce891c17814927167166c75f944fd1b8a51e0246381ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b810c95cff3cef2da340fc2013424380

SHA1
c15394442bdc065488cad572a753f8192b0f470a

SHA256
8dcc8b865a5b56f4bcaefde539c5b0198a1c46240d564a557c193632d8d5fade

SHA512
325226cb9afc196e1c440e3081bd5087ad05b08a3dd8a50edbba9ce0d6c5f95aabcd74a703ffc8687f1d279778269af891d05c09616b780efd211c48f706de1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
f7013f75dc89eb1e82e53ccb0238f3ef

SHA1
ede0035b288dd35ae56def3c894489ae9fa8c1ab

SHA256
e7f0abb30b15721b4e5c17ce1ce122d9a11e9789b9f79ff4782c0d1a58f12332

SHA512
159e64794cc9dc4380069823500674ae082a325be25c2aa70bbc24c19df8e114b50332aaa58f941cc8eb8f5dbe9525bbb4c145603d9e570cbd2ec38688fd7dd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
5ec9b4a16faa3614502bd787f56f6063

SHA1
392b61614de620b139ac3f78ebe041597dbcefab

SHA256
a73840599e6d7a65748aa27179e96732751afac6458520a35230094bbfafbf47

SHA512
237ce1507283baffb7507c245ffcb2557ed7a3cb4445204aef449e264e549e15ae62ea31c243c0eeb33ef1168edfd0d1e7c740e4ca126cc3b23ffb73a25353f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bc4b.TMP

Filesize
874B

MD5
9186bbef10e3112f438334bffbe0a300

SHA1
31c285e3ae92c87e61b27537213ef2ee2ac16cc1

SHA256
07e5976e54e8f1c2358b479e1a531ace7358b71e4fec3a3c804d04e7c86e80fc

SHA512
f55172fa674ac5722a8a2b13fc5c08cb8fd8b83f7336b237538ded731db9bb925bf0c5932577520fca487b8b1ac7a39363dbbae9e66376713ad3c29e0637f636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d0e3644215284bf1aee6eac6da070955

SHA1
dd4bdf8621d251c202021d3319b6ade6c562fbb9

SHA256
d33896e4d255186e49675ba2950bcfe460c91a3561c1a1c1a4d0bfc6aee67d85

SHA512
fae92e43d3d5c72aac183e1b2300b5da7fdf35c7fc80b9ab2ef9685b1e72e393d591426b76c95f50dadd0e6ff4c4fb2102b4ec812e318d8a8de78dfc11ce4ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b918778c31dccf62d31d811951def7f7

SHA1
f90bcab10445c0c7aff78b25e4490a11cf14c21d

SHA256
6e657ff07d9045885647d2e592f196c28749035661c14a8cc43ae99fa61e8559

SHA512
9542e7c75cc99038825bf443b6295497f728698ee53008c271ceb629fb7f1a00aaf218409fa895fb84ab462174cd1874f28427ba7c4eb8505d8186c3e440f4f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
63fa82e7a547f4aec979f5661dfb42cd

SHA1
112a1128551f5127fbde2b96d7a5f15ec216b082

SHA256
56b18b7f9cbe7c64f5a70eca927804d5093bb482897ba3d0c09d4148a07bb5b4

SHA512
77a94cad37a6185166b6f47b28cf71f8ee4ab6709753df584b5fd6a0bd8afb42ab550da76b8788271f5a7dca6384a20d16c891602f203eb6b92c018cae2e3f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
64c46394f134a732d665ad1052d97f6d

SHA1
e0a2cb3ef99bfd5236ed03165f76388cae7eb8bb

SHA256
6396644e2eeaedc482bd178131bcec88a7a35e3a23e93bb9346fb5408da337ea

SHA512
eb4e04738e44187a5693aa41fcf1bc10521ac14df1d1f86db960db7fcfc79dc3843258196eef3eafa462dbe5ee0e9ca11542c250c4e210c9bd57a56f6b32be0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c5cb605d81f5085fd9371bc3c88b6470

SHA1
6d4e42c855f852bd6fb7c18a5d7a17ea3820ca24

SHA256
41b47395d730d522e84d08bf741814edcaf162e61b7ccac5ea9e75bb8d949b02

SHA512
7ea7ac3a5d8024220852b4ea90ee3c73daa31ef67082e847b2c4bb8acc32a9723885a4b6106ac4d0624d6cafec717f891797102e46e84660f213c4c31b553249

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vjghrvxu.zjm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\M.Centers.4.0.x64.zip

Filesize
4.0MB

MD5
bd8fb64a446e8cb10464917211745f8b

SHA1
ce8c6630662ff51fd5624a12d6d901fece5647cc

SHA256
e8ca076034148befad0e8e91699bdcaef98e4c689ac0821fb4e8351841f68e3c

SHA512
752e1d12424086915a3431ce1f151020a2aa5b4cf91dd83c87732ce9254392ed1f3a169f2c024804c272db6398d976d3c2dc22fe5457c2f8fee6a559f7f97994

Download Submit
C:\Users\Admin\Downloads\main.zip

Filesize
1KB

MD5
237293e75cf756f681915ff98957cf60

SHA1
aa1831cd6d96366ec1b258a2d2776d2d799e789f

SHA256
44a709dace508febcd3f2e3bf0bd6a4c8cd0b03b5bf44c604bf5d989c8c36811

SHA512
f55313cd64283535b98c197583c54f85161f384c86112f6b0d5c2205a00d2a3a80dbc1ee58c90286f0f3b8b562691a978da3ce9da81e4552afaf7f47e058c04a

Download Submit
C:\Users\Admin\Downloads\main\19041.1288\x64\Windows.ApplicationModel.Store.dll

Filesize
2.2MB

MD5
c4580846fe483f21ceab8aea5c9c953d

SHA1
9ea59bacf79ebf4d1b783edb42be06989258b249

SHA256
b6fdc0ff208e09e48a6d15397217b4193cb99c809308292eb455c8b7ae4d2d36

SHA512
5128198e6d6b2280172ba81a913cb726a0b10f3d721e0631dc44de4a2fe0ace356cdbd08115b28b141b52b1b6d02fd8da0171a0fc15da98e8594a713817e44e3

Download Submit
C:\Users\Admin\Downloads\main\19041.1288\x86\Windows.ApplicationModel.Store.dll

Filesize
1.6MB

MD5
2e35e9a30242eee6d7d3600fa9a86be7

SHA1
c348a17d1c98cadda81152aaee1a3bd9666c8c56

SHA256
2a15dd58e6ad37c496f0f599eaf85e863b10f6cb519ad398c25f0ada44f1bca4

SHA512
e225a35e957ef15d81ddf2c0a05771b22ad61aa93c5b629794d5ec4c274c999340c78688a30824808876a3da54fd55b41df9841208e57aca43f89e3b714b6e26

Download Submit
memory/2764-252-0x00000178BD380000-0x00000178BD3A2000-memory.dmp

Filesize
136KB

Download
memory/2764-280-0x00000178BD890000-0x00000178BD8A2000-memory.dmp

Filesize
72KB

Download
memory/2764-281-0x00000178BD860000-0x00000178BD86A000-memory.dmp

Filesize
40KB

Download