babylonrat | hxxps://cdn[.]discordapp[.]com/attachments/1251014264551112735/1254140725260456006/Minecraft_account_generator_2[.]zip?ex=66b7b111&is=66b65f91&hm=e87ba25aac9637a01fc1cd8ee57e7803e9ee2531600a53266e81bb6c614dad55&

Analysis

max time kernel
69s
max time network
64s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09-08-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1251014264551112735/1254140725260456006/Minecraft_account_generator_2.zip?ex=66b7b111&is=66b65f91&hm=e87ba25aac9637a01fc1cd8ee57e7803e9ee2531600a53266e81bb6c614dad55&

Score

10^/10

babylonrat discovery trojan upx

Malware Config

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1716-81-0x0000000000370000-0x0000000000439000-memory.dmp	upx
behavioral1/memory/1716-88-0x0000000000370000-0x0000000000439000-memory.dmp	upx
behavioral1/memory/1716-101-0x0000000000370000-0x0000000000439000-memory.dmp	upx
behavioral1/memory/1716-102-0x0000000000370000-0x0000000000439000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Minecraft installer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Minecraft account generator_2.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
1456	msedge.exe
1456	msedge.exe
4960	identity_helper.exe
4960	identity_helper.exe
1504	msedge.exe
1504	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1716	Minecraft installer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1716	Minecraft installer.exe
Token: SeDebugPrivilege	1716	Minecraft installer.exe
Token: SeTcbPrivilege	1716	Minecraft installer.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1716	Minecraft installer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 4560	1456	msedge.exe	78
PID 1456 wrote to memory of 4560	1456	msedge.exe	78
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 2176	1456	msedge.exe	79
PID 1456 wrote to memory of 704	1456	msedge.exe	80
PID 1456 wrote to memory of 704	1456	msedge.exe	80
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81
PID 1456 wrote to memory of 1832	1456	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1251014264551112735/1254140725260456006/Minecraft_account_generator_2.zip?ex=66b7b111&is=66b65f91&hm=e87ba25aac9637a01fc1cd8ee57e7803e9ee2531600a53266e81bb6c614dad55&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff959eb3cb8,0x7ff959eb3cc8,0x7ff959eb3cd8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1836 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1828,8726842175867616325,4622485287207432644,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3192

C:\Users\Admin\AppData\Local\Temp\Temp1_Minecraft (Unzip).zip\Minecraft (Unzip)\Minecraft installer.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Minecraft (Unzip).zip\Minecraft (Unzip)\Minecraft installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
52d301035dba84ee129b5460227ed60c

SHA1
8c7666fe27b08103fc64cdce2a07d670e366d4b5

SHA256
21b21a5bc9dbfd5cbcf812af27c6462a6442424975e3b1d22ad54f07ff2fbf76

SHA512
0d48a27ffd01c743371067bf9444897b5cc61845e002a09d4384fa53f3c89f7676477e54c1de6e8d5af090b74de962863865baffc88bf53592403c92e83b232d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7bc1c836cac0e81054a570ba5628158

SHA1
1eba04abf74e198fdaf814733a097890b1770eae

SHA256
ee9ea7dba493d21aa5c695bc7251fde4cfcf083461adabf8d2dd4caa91776baf

SHA512
2e2a949a08a53b7137a8496b7a35a3d535689366bd0a1040fde4133ad735786c6ca3c409d360088f2c90c069c36e0abe3d7593818a067994f922287c5896a12f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34f4e55a36bd17a12f1719455264d524

SHA1
9432eab06d807ffd638c6fdab83ca8216be4facc

SHA256
80426ed3fdb5695bd22e9fa9d2529b5322303cdc0da32c19549b9376fca654ad

SHA512
f330746d8927d9699e39f7e720fd485c832999af0b076b8e2f3e5bbb670c806057f01d4aecda1f59e4eec9f275db59958b94d833f013dc883bffe778a39deaee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df94545e3c455e80c7d95eb0d2516f83

SHA1
f12fcd5ff3a9415cc2170d2e98e06a0b7284a0d8

SHA256
ee78814d7f848461f9e8847acdb91a2c1925416775c2ecb0dc887e14bb0af7db

SHA512
11b4deb373e508831fac6ff6e8ec13995c0401f8e9ed35125db5cfeec73b1dbc090d45d7805615dbf5a4a3c9cd52fc904e081163d3b74f76f8e12d5d8a27d6f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
60647ddc869109a55d634a84dcc46b7a

SHA1
a7b18e0d18af52bfa2a094b47722e847f6983063

SHA256
0db97242309dcc30178ff449f40c6545c145d2995458de3743d167b1a1e34109

SHA512
b832006aedd180c488a1bed127ed8156feb46b54f147849113e7a32f5784da540b8f5e2086343a6f107016a14708d9716fb3592cffbf687f691b28161a3b0e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
67c48d0f9cb23cb551e4ca1869af3386

SHA1
9239823b17c8f5afc5dc8daa4cd805c86150244b

SHA256
576065b638fdfe39257ab9756fadefceccf980797624ae1f4923601285d1148d

SHA512
8f110a3001ad69d22a453ddd638312c49ba8c571e39c17bc105e69aaed4c4d6206a94a323381c08e53cfff0e45de44ba8c99dd44e14ffaf3ae008edfee523771

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9cc4b8eb0b00dd92d0df0e4f162b69f1

SHA1
e10baeaa6e126678a7f73e0eb4ff1b42806a6447

SHA256
45d6dfe9b8fb530c1cb1a4abd297a536fe764d2393ba82e8907221697838e594

SHA512
744b209b3866c0462a66c17baace9bc76d5d2c159dd0277f898706ebc2e412791abe8166820c5513a56ddf0d02993b82cf635d3fa22e71ad5489b1f288f6cb3a

Download Submit
C:\Users\Admin\Downloads\Minecraft account generator_2.zip

Filesize
351KB

MD5
b98371939b3da0fce18915f5e6c28de3

SHA1
b1914e49087ff06258e8dce4d5b3edb464ee5875

SHA256
bd56259cdd83e93a9aa2cb5b9c26bc09609ef8c9bc1ac9989d3e128b40088e77

SHA512
1955a2040750f32d5ccf519f8f1d487944de2f48a2078b165fdbcd00493e7af2d7d8bd2b87ee65d7ad30b71adf0629bc480bd4effbb5d15be70eaeecff5b4f7b

Download Submit
C:\Users\Admin\Downloads\Minecraft account generator_2.zip:Zone.Identifier

Filesize
241B

MD5
9fa2368a4d7564c8b3a6e81f4983c2c2

SHA1
da3b88799798cdbf7f539886f7ea62de61d54112

SHA256
3b301f88777d7562b7f0b7f82213c337df7eaaaff3c6e5620ba283b7cb7915dd

SHA512
b28e06d545722cd52581313daf7e7ecb610bc39f5395a414b791ca5d3cb487f7919c399291ab0f39baf394164ceecad5a2a6c77aca3295d8bac9cb8930877777

Download Submit
memory/1716-81-0x0000000000370000-0x0000000000439000-memory.dmp

Filesize
804KB

Download
memory/1716-88-0x0000000000370000-0x0000000000439000-memory.dmp

Filesize
804KB

Download
memory/1716-101-0x0000000000370000-0x0000000000439000-memory.dmp

Filesize
804KB

Download
memory/1716-102-0x0000000000370000-0x0000000000439000-memory.dmp

Filesize
804KB

Download