hxxps://cdn[.]discordapp[.]com/attachments/1231039315505844284/1270522600640217151/NYX_4[.]5[.]zip?ex=66b4aaa1&is=66b35921&hm=893f10ecdc7fbbd97c927c043e17c032c1c435ac35803f36bb8ef1d246bc6aea&

Analysis

max time kernel
80s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1231039315505844284/1270522600640217151/NYX_4.5.zip?ex=66b4aaa1&is=66b35921&hm=893f10ecdc7fbbd97c927c043e17c032c1c435ac35803f36bb8ef1d246bc6aea&

Score

7^/10

discovery vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/6064-114-0x0000000140000000-0x0000000140AEF000-memory.dmp	vmprotect
behavioral1/memory/1516-146-0x0000000140000000-0x0000000140AEF000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
6064	nyxplayerbeta.exe
1516	nyxplayerbeta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1076	taskkill.exe
3988	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Nyx.exe = "11001"	Nyx.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
3620	msedge.exe
3620	msedge.exe
1064	identity_helper.exe
1064	identity_helper.exe
3476	msedge.exe
3476	msedge.exe
6064	nyxplayerbeta.exe
6064	nyxplayerbeta.exe
6064	nyxplayerbeta.exe
6064	nyxplayerbeta.exe
1516	nyxplayerbeta.exe
1516	nyxplayerbeta.exe
1516	nyxplayerbeta.exe
1516	nyxplayerbeta.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeDebugPrivilege	3988	taskkill.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4056	Nyx.exe
4056	Nyx.exe
5400	Nyx.exe
5400	Nyx.exe
5580	Nyx.exe
5580	Nyx.exe
5896	OpenWith.exe
5180	Nyx.exe
5180	Nyx.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4736	3620	msedge.exe	84
PID 3620 wrote to memory of 4736	3620	msedge.exe	84
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 2100	3620	msedge.exe	85
PID 3620 wrote to memory of 5080	3620	msedge.exe	86
PID 3620 wrote to memory of 5080	3620	msedge.exe	86
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87
PID 3620 wrote to memory of 4108	3620	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1231039315505844284/1270522600640217151/NYX_4.5.zip?ex=66b4aaa1&is=66b35921&hm=893f10ecdc7fbbd97c927c043e17c032c1c435ac35803f36bb8ef1d246bc6aea&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccaf746f8,0x7ffccaf74708,0x7ffccaf74718
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4732 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13857503081741162887,3703048498448929106,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1152

C:\Users\Admin\AppData\Local\Temp\Temp1_NYX 4.5.zip\Nyx.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NYX 4.5.zip\Nyx.exe"
1⤵
PID:2164

C:\Users\Admin\Downloads\NYX 4.5\Nyx.exe
"C:\Users\Admin\Downloads\NYX 4.5\Nyx.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4056

C:\Users\Admin\Downloads\NYX 4.5\Nyx.exe
"C:\Users\Admin\Downloads\NYX 4.5\Nyx.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5400

C:\Users\Admin\Downloads\NYX 4.5\Nyx.exe
"C:\Users\Admin\Downloads\NYX 4.5\Nyx.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5580

C:\Users\Admin\AppData\Local\Temp\Temp1_NYX 4.5.zip\Nyx.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NYX 4.5.zip\Nyx.exe"
1⤵
PID:5764

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5896

C:\Users\Admin\AppData\Local\Temp\Temp1_NYX 4.5.zip\Nyx.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NYX 4.5.zip\Nyx.exe"
1⤵
PID:5952

C:\Users\Admin\AppData\Local\Temp\Temp1_NYX 4.5.zip\nyxplayerbeta.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_NYX 4.5.zip\nyxplayerbeta.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  PID:4548
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  PID:4732
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1076

C:\Users\Admin\Downloads\NYX 4.5\nyxplayerbeta.exe
"C:\Users\Admin\Downloads\NYX 4.5\nyxplayerbeta.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1516

C:\Users\Admin\Downloads\NYX 4.5\Nyx.exe
"C:\Users\Admin\Downloads\NYX 4.5\Nyx.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\31a7be7f-7326-4bbe-b57b-93156cccb82f.tmp

Filesize
11KB

MD5
b9d3ec8dc0445b8699d78891e19c6ef8

SHA1
96e542e0a266e84d298317e03ea201983dabaa2d

SHA256
51b650df8a632f05a79af114e765686b91a262ae95714b5469bccb3e4b6f3c9a

SHA512
99d3d063b801a3a70cba53b6b7ad2529c14e77b858a7e51e7ed1b7ffd0770af057341f80a56f5feba03012df815699f212ff1e9aa3595c1ee32afa4862e66a02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64bfd2951d7caef6e8f75455995d1a3e

SHA1
5dbe64469aa8140e9c40deb3107e6c67119008b4

SHA256
4d3c01a54722cf6d0afd1226819726db82d09221f7be1060f7c60e5cea9b2516

SHA512
3fc116877665762eeea2a5a7826a07344f44cc3043da5c2cb1da23b92f8258b745e19fc91d26ebe698538f4c7e54a97a9b3c1b1bb06bf89176d5e19887299b83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f36066dac86eed8921c7be378d14d781

SHA1
d46ca8df8ff0dc9fd098cc0fa9bc3c3fea2436db

SHA256
6c13c2289181e4e468d7c4c9c856196b3549e7ff1dc4f4476613cb210a08d3d4

SHA512
564685286e4770dbfd335a43ee23cd723fc6f4c44b30ea84466416038ea41954f6490238d891855ea45f6f132179eaa9ce717aaba93f40e1c6f5f269e9941f43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44ea5e89ce3b97257a071688a956a761

SHA1
ba0ad1890235d75c5994e1408e4a6fba146def0b

SHA256
0862b7f0427e89693e8fa95b2deb2179e562c9cbf04e1d4c2b0ef90f2bcf3148

SHA512
073a5e7c85d500ca389d1eae150b0e676355e788ee6c7844ba75b1f5a040f0f0b317ddd46081b1132962d66a9414fc4baec69bfaa5cf4b1f878592ef25234523

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2f8a620f3a722bdcdf5cc17d4174a54b

SHA1
1f6a12c3e294812a7f030df9e72dc81a91d46140

SHA256
ebec90af057c2ce53b5cbc1b8b5a21864670dd1d8f9b9890747dceee35d55942

SHA512
87f92923ae3f2297cc7ed3c67f160021c05c95926eeba1c513d044de0bb565f90c7dbc151c34478989d7c75ab22790cf30ddf5362a3d3e395321205968a3b06b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
85992116bc37328bfb2f53e119d82c61

SHA1
013f48e8a09e0cf68ab0f19a3cf29a4ad11df260

SHA256
e67d1bd8fc9dc6c42c806083f00d343bff8f92a3371944d9b173c4f7b42a8ddd

SHA512
0b859072a825d9cb86540831f272d19ac130d0ef576cfa1d800d6b77063a3928a24ecad955d81ca76bd5596290e7a27bce86fb89f15dc4b0f1ecbaaefbed195a

Download Submit
C:\Users\Admin\Downloads\NYX 4.5.zip

Filesize
9.0MB

MD5
52d5ebef8b441b82f87dcf928a382336

SHA1
e9bb0a4fdd23e5345b8d9eacd50f6eb2568f9271

SHA256
ca09bc895dc8a2d064c9627c83fb66de8224e85ef4988e04ea2416905c27d218

SHA512
978a08f42cfe71fec7cf314ea9e3f2cb10975fd040a3ed6442f4bb2ed44b0008048e1f7805e475b167c770d4ca3a1d0849442ba799749c77711a4f165189b90e

Download Submit
memory/1516-146-0x0000000140000000-0x0000000140AEF000-memory.dmp

Filesize
10.9MB

Download
memory/2164-57-0x0000028EB7E40000-0x0000028EB7F94000-memory.dmp

Filesize
1.3MB

Download
memory/4056-76-0x000002D7F5FA0000-0x000002D7F6376000-memory.dmp

Filesize
3.8MB

Download
memory/5180-159-0x0000027249E40000-0x0000027249F40000-memory.dmp

Filesize
1024KB

Download
memory/5400-83-0x00000169726D0000-0x00000169727D0000-memory.dmp

Filesize
1024KB

Download
memory/5580-89-0x000001B046160000-0x000001B046260000-memory.dmp

Filesize
1024KB

Download
memory/6064-112-0x00007FFCD93D0000-0x00007FFCD93D2000-memory.dmp

Filesize
8KB

Download
memory/6064-113-0x00007FFCD93E0000-0x00007FFCD93E2000-memory.dmp

Filesize
8KB

Download
memory/6064-114-0x0000000140000000-0x0000000140AEF000-memory.dmp

Filesize
10.9MB

Download