Analysis

  • max time kernel
    54s
  • max time network
    56s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/06/2024, 01:08

General

  • Target

    CrackLauncher.exe

  • Size

    5.5MB

  • MD5

    52aaa8c3fd6b813b713ae05ab9e4829c

  • SHA1

    d4ac8addbe5e15e867afe58f4bbb8319395ad38e

  • SHA256

    0c30d4cb510304d4ce140952f8ce316056cc4bc552cef78a81fd5301aecc1fd2

  • SHA512

    c39bba95a8554f1115d0362bad33901fd87e00d5de7671cd48d7b537c97889882b9009a83948087cf8516a32588e4ef831531977740b17a2791cec927934fdd8

  • SSDEEP

    98304:SJuJhPWclzxum6p/GuTIZULvC6LcbE6HGek94x1RK22cJfcdnidC7GpWhGrj6j:QuaAxSTZLvD6/x1R92cJUMo7xS6

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\CrackLauncher.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:3224
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/cFP4U9qTwV
        2⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2864
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa5b0e3cb8,0x7ffa5b0e3cc8,0x7ffa5b0e3cd8
          3⤵
            PID:928
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
            3⤵
              PID:4768
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3124
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
              3⤵
                PID:4964
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
                3⤵
                  PID:4720
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
                  3⤵
                    PID:2824
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
                    3⤵
                      PID:1748
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                      3⤵
                        PID:4348
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
                        3⤵
                          PID:2728
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5084 /prefetch:8
                          3⤵
                            PID:2488
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4036 /prefetch:8
                            3⤵
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4220
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
                            3⤵
                              PID:804
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
                              3⤵
                                PID:5056
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
                                3⤵
                                  PID:3604
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
                                  3⤵
                                    PID:3128
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
                                    3⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:488
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
                                    3⤵
                                      PID:5080
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,2042376757512720234,11307771826693666670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2872
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/sk3d_club
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3860
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffa5b0e3cb8,0x7ffa5b0e3cc8,0x7ffa5b0e3cd8
                                      3⤵
                                        PID:472
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,14495412570295014158,12265214805155676690,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:2
                                        3⤵
                                          PID:3152
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,14495412570295014158,12265214805155676690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
                                          3⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:560
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:4420
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:4568
                                        • C:\Windows\system32\AUDIODG.EXE
                                          C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D8
                                          1⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2592

                                        Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                6876cbd342d4d6b236f44f52c50f780f

                                                SHA1

                                                a215cf6a499bfb67a3266d211844ec4c82128d83

                                                SHA256

                                                ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e

                                                SHA512

                                                dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                Filesize

                                                152B

                                                MD5

                                                c1c7e2f451eb3836d23007799bc21d5f

                                                SHA1

                                                11a25f6055210aa7f99d77346b0d4f1dc123ce79

                                                SHA256

                                                429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800

                                                SHA512

                                                2ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                5KB

                                                MD5

                                                91c885b83e829dcb036fdb009b9e3ad9

                                                SHA1

                                                91c6bf477a793bd59c0b61e6ab583082467c883f

                                                SHA256

                                                1a1e47b129799be9a063407a97d6e03cc383a6e460d13dc8576ac09b3bbd264e

                                                SHA512

                                                7e054e2a317d3ab4a698e04929fd317f3eb611276050b1e8be052899d7bbcfb127e1386c4975635dea3880c1a7cdacde538913218f308db5a6dad2f3edc43445

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                462034e192c2b54a6b8c12c046cfc0f9

                                                SHA1

                                                7429ef21e0a739d761f8e0108dd144ca3a7d628d

                                                SHA256

                                                a9f4a322c4196af32cc5d6e57044989120354e2746827a3a65d0ccdb61ac6736

                                                SHA512

                                                c9ba479792c2d053f3ea5d0bd29f3a60a477a5774e3ad0b501bcdb1262a72286ae8d76e17ed93d21ab75386d2f53b896bcaf6982fc6bdb688f2bea964bce1a0a

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                Filesize

                                                6KB

                                                MD5

                                                dca939cb97c0a12f5e7b5c1ce3bd9954

                                                SHA1

                                                5877b152a55e363508a271d86c657a1c4bd0cb7f

                                                SHA256

                                                0ad5df85bde747539ae84c277aa909ea4f136fa05e83633457f44ed3ef7e0214

                                                SHA512

                                                15d4cefe03aae3fe443a97a5e16f472e010b803403ddb258882b2cb37d729a9503126df75b737025011f0868af18095e17029d7473b8c6b95ac996111fd70a22

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                1KB

                                                MD5

                                                b3da7afbbf1965a40578c278e46ab2b5

                                                SHA1

                                                658d917704e5a4dc1e51a83974b1ccf166ffad86

                                                SHA256

                                                c9704fd1fdc6cb2974d02263468c452cce9af587f9ba34ac8950dda68d4014b0

                                                SHA512

                                                8e5569638c508ca353ec5ff915c913c599f03e239bd044ead1ad69ef797f15ef6beaa4e42e55afb0ef3feaaf3882beba20a95596087e12a388ae1f68ba8ed151

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                1KB

                                                MD5

                                                6e0b6b4646ef30c1d82edf19eea5a776

                                                SHA1

                                                2a214af33df27a063bbb6290435753b38c53414d

                                                SHA256

                                                1e6dfea335d87f8ce966bad6f569d41c7ace475bdea7378ad7416535375455d3

                                                SHA512

                                                3b6eccfd5437ebcf33741a06ff226f4efac327b7d14e44d458c7d6451d54bb70f2e1990fac9789b675d8fc0cb32e9ad5515cae7911864bd78983b3cdbc8f5d4e

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                Filesize

                                                1KB

                                                MD5

                                                a5d429aad1fd21bbc961139b01579284

                                                SHA1

                                                419666f23fe8cb0e3d2b2eede1f9ace8548608dc

                                                SHA256

                                                57c02fd838cff5ab1bb1368963fed40580a68b1e7af9e6f75275e7b7232bb494

                                                SHA512

                                                afbecaa00e45b66e773da02b520e4c56d42e077b5651045512177e8f2c759f84bfc03479d3c39da1714d3c4c57ac9f3214fec19a1fb1e15b6c518cb433ec2ca0

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d8ad.TMP

                                                Filesize

                                                872B

                                                MD5

                                                4a8f1c92ec44e6ae7d31753d1037d543

                                                SHA1

                                                10904854b9e2b3d5bbe6568ac4d0a60c2d156a92

                                                SHA256

                                                7e6388e3e5ded1c8fe303a62ac55bccdff21b7aa568caad3415f58655aded703

                                                SHA512

                                                4082e1ddf6bb60fd436362f1f75ccf627abcbc5776359528b28e5083fa9f650674e552b48d0f36fecfb2362449423b003fe0471690251665fe8189bd260be96c

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                Filesize

                                                16B

                                                MD5

                                                46295cac801e5d4857d09837238a6394

                                                SHA1

                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                SHA256

                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                SHA512

                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                Filesize

                                                16B

                                                MD5

                                                206702161f94c5cd39fadd03f4014d98

                                                SHA1

                                                bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                SHA256

                                                1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                SHA512

                                                0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                Filesize

                                                8KB

                                                MD5

                                                17b3a09266062fb00a5f317062360782

                                                SHA1

                                                3325957e55c6f3cc1569b075a04994d00dec59a6

                                                SHA256

                                                ee80dff8ed4c5c80895a1dd71b1dff43638f2b91eb037a38fa00a903723fcd8c

                                                SHA512

                                                a4f6b58b3ed5146b425d2eb32dadb8c45a2755d5c69f4d8083a6b4929b9b8c3b7118e87c5e8aaa248dcd9dc89d8271bb9ab276c4db7046021f6dd1b4670b7a59

                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                Filesize

                                                11KB

                                                MD5

                                                4f15a9ca80757f4a5eb095a50fd6eb94

                                                SHA1

                                                8f7e0e12146e8926b674999867b7d96b75504efd

                                                SHA256

                                                280c4ce8a72196a0c168011943431078613ad9d64345e7b3d1a73e518e147a86

                                                SHA512

                                                d66f042e371667d06be131560658d2fcf1198a97ea33e6f8479ebf2aa4e40eb64feb7ef760a6e87c791a751a541d6aa0c9d6df56a06238ad8523b35afa95a566

                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                                Filesize

                                                2B

                                                MD5

                                                f3b25701fe362ec84616a93a45ce9998

                                                SHA1

                                                d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                SHA256

                                                b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                SHA512

                                                98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                              • memory/4732-48-0x000000014000E000-0x0000000140347000-memory.dmp

                                                Filesize

                                                3.2MB

                                              • memory/4732-49-0x0000000140000000-0x00000001408C1000-memory.dmp

                                                Filesize

                                                8.8MB

                                              • memory/4732-0-0x000000014000E000-0x0000000140347000-memory.dmp

                                                Filesize

                                                3.2MB

                                              • memory/4732-2-0x00007FFA6A500000-0x00007FFA6A502000-memory.dmp

                                                Filesize

                                                8KB

                                              • memory/4732-5-0x0000000140000000-0x00000001408C1000-memory.dmp

                                                Filesize

                                                8.8MB

                                              • memory/4732-1-0x00007FFA6A4F0000-0x00007FFA6A4F2000-memory.dmp

                                                Filesize

                                                8KB