zharkbot | hxxps://financemastersacademy[.]com/inc/2[.]exe

Analysis

max time kernel
43s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-09-2024 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://financemastersacademy.com/inc/2.exe

Score

10^/10

zharkbot botnet discovery

Malware Config

Signatures

Detects ZharkBot payload 3 IoCs

ZharkBot is a botnet written C++.

resource	yara_rule
behavioral1/memory/4872-83-0x0000000000400000-0x0000000000454000-memory.dmp	zharkcore
behavioral1/memory/4872-85-0x0000000000400000-0x0000000000454000-memory.dmp	zharkcore
behavioral1/memory/6076-130-0x0000000000400000-0x0000000000454000-memory.dmp	zharkcore

ZharkBot
ZharkBot is a botnet written C++.
botnet zharkbot
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
5684	2.exe
1140	2.exe

Loads dropped DLL 2 IoCs

pid	Process
5684	2.exe
1140	2.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5684 set thread context of 4872	5684	2.exe	118
PID 1140 set thread context of 6076	1140	2.exe	130

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2668	4872	WerFault.exe	118
5160	6076	WerFault.exe	130

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 824355.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 440018.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe
3128	msedge.exe
3128	msedge.exe
5560	identity_helper.exe
5560	identity_helper.exe
5768	msedge.exe
5768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 4848	3128	msedge.exe	83
PID 3128 wrote to memory of 4848	3128	msedge.exe	83
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 1020	3128	msedge.exe	84
PID 3128 wrote to memory of 3336	3128	msedge.exe	85
PID 3128 wrote to memory of 3336	3128	msedge.exe	85
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86
PID 3128 wrote to memory of 1688	3128	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://financemastersacademy.com/inc/2.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa0aa46f8,0x7ffaa0aa4708,0x7ffaa0aa4718
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1816527841132486816,3143686099721486328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5308

C:\Users\Admin\Downloads\2.exe
"C:\Users\Admin\Downloads\2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:5684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 440
    3⤵
    - Program crash
    PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4872 -ip 4872
1⤵
PID:3616

C:\Users\Admin\Downloads\2.exe
"C:\Users\Admin\Downloads\2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1140
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:6076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 412
    3⤵
    - Program crash
    PID:5160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 6076 -ip 6076
1⤵
PID:5444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2.exe.log

Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9876420e6a12ff453ee123721b3768b7

SHA1
dfe5a7dbb07e601a86ecabb66ddcaa5d2c73c8a2

SHA256
4c316039a128e6c3d35101ba3595bb064f4b0d118a001584deedd458b897106d

SHA512
d478b1d159e750118dad768d3eab9eb1c0d277ab00bfa08fb11af7d8c933cb3d6dc8a7b2987ffaaa47c1b0165b71ec698001e0b3ea9d7e4bfd35026b05793283

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
776b7c723bd9f19bdb39d4c231fd8758

SHA1
5460bcbf8a47820aa864be9d7053ba3eb0403f4e

SHA256
789c488d577b2da5254c29cfb478e094ca1c4ced97834907e080b46a61675335

SHA512
0efd78ec18145d76dceda6d136bcb881279bc07a7262e054cfabf0064d7d1b103d1498f142a870c9546414f4d7ffcca908ced0a3cf62dd46ef0bb58cc33a5875

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ce3b50a3aa6eb28eabd2977befe04fca

SHA1
8b044c12d3928ccc2f003fa02b71710f2f73ef05

SHA256
cc741a10afe308712dc1a2b9ca413cc9c80f4ab0c1fee9478ab5a16efa07c4c8

SHA512
98b5e16e94d5518b56733de4ba0bc98d45dbf3b352cc914175405cca59e7633e287e6a7bdca9f4d2c859febead3efb31a79197702f0d72ce2ecec49ec14729f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d92445f094a44a6a8acd3a8fd8b2a6b7

SHA1
0873c4c37d0df8d279ab1fba0285eb825eaecd97

SHA256
033761cbe6949108225d5fa557e2b586e902e005ab44778111f12b9720bbbd2a

SHA512
fc7740a46d3d1805f2c07d182d74af8b4be24ff311fef0510a6a26a27de677f880f9098d0b7a2754675506c7efc47645a7150483435bb7cc7cd840eb5f2e37c7

Download Submit
C:\Users\Admin\AppData\Roaming\d3d9.dll

Filesize
534KB

MD5
a6da8d868dbd5c9fe6b505db0ee7eb71

SHA1
3dad32b3b3230ad6f44b82d1eb1749c67800c6f8

SHA256
4ad69afb341c6d8021db1d9b0b7e56d14b020a0d70739e31f0b65861f3c4eb2c

SHA512
132f54ac3116fd644c57840c893dae2128f571a784ceaa6dd78bafa3e05fc8f2a9d2458f1e1cf321b6cecc2423d3c57ff6d3c4b6b60f92a41b665105a3262dd0

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 824355.crdownload

Filesize
673KB

MD5
b859d1252109669c1a82b235aaf40932

SHA1
b16ea90025a7d0fad9196aa09d1091244af37474

SHA256
083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c

SHA512
9c0006055afd089ef2acbb253628494dd8c29bab9d5333816be8404f875c85ac342df82ae339173f853d3ebdb2261e59841352f78f6b4bd3bff3d0d606f30655

Download Submit
memory/4872-83-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4872-85-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5684-76-0x0000000000840000-0x00000000008EE000-memory.dmp

Filesize
696KB

Download
memory/6076-130-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download