85d479d2144a9f0d7fe963d37b4969e8f9d41ec673967e8daf7b32ffe8c88a60

Resubmissions

12/09/2024, 14:22

240912-rpwkhaydmp 7

12/09/2024, 14:21

240912-rpcsdsydma 7

Analysis

max time kernel
35s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 14:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Top 5 FPS Boosting Packs.exe
Size

1.6MB
MD5

eb707ae3be461641ec166fdd6a9e59a9
SHA1

2295357e7cf54d4e583effe16c924053e29e9848
SHA256

85d479d2144a9f0d7fe963d37b4969e8f9d41ec673967e8daf7b32ffe8c88a60
SHA512

d04d63d32ff3a5b32ef390ecae3ad0cbc5f848c99f2a76a6de4c11f59eb33fe44fc6a89ff8fdf9f9ca88984a40dbc8194a4121b78cdfa9c345afbc8be89a84aa
SSDEEP

24576:gawwKusHwEwS2QGqKwGzO6I6h6gEGe/NIsWvMyCShxSR:wwRED0QShv2NuMsSR

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2644	Top 5 FPS Boosting Packs.tmp

Loads dropped DLL 1 IoCs

pid	Process
2644	Top 5 FPS Boosting Packs.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Setup\unins000.dat	Top 5 FPS Boosting Packs.tmp
File created	C:\Program Files (x86)\Setup\is-5T97H.tmp	Top 5 FPS Boosting Packs.tmp
File opened for modification	C:\Program Files (x86)\Setup\unins000.dat	Top 5 FPS Boosting Packs.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Top 5 FPS Boosting Packs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Top 5 FPS Boosting Packs.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
2924	msedge.exe
2924	msedge.exe
2376	identity_helper.exe
2376	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2644	Top 5 FPS Boosting Packs.tmp
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 2644	3904	Top 5 FPS Boosting Packs.exe	88
PID 3904 wrote to memory of 2644	3904	Top 5 FPS Boosting Packs.exe	88
PID 3904 wrote to memory of 2644	3904	Top 5 FPS Boosting Packs.exe	88
PID 2644 wrote to memory of 2924	2644	Top 5 FPS Boosting Packs.tmp	97
PID 2644 wrote to memory of 2924	2644	Top 5 FPS Boosting Packs.tmp	97
PID 2924 wrote to memory of 1468	2924	msedge.exe	98
PID 2924 wrote to memory of 1468	2924	msedge.exe	98
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 1920	2924	msedge.exe	99
PID 2924 wrote to memory of 220	2924	msedge.exe	100
PID 2924 wrote to memory of 220	2924	msedge.exe	100
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101
PID 2924 wrote to memory of 3844	2924	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\Top 5 FPS Boosting Packs.exe
"C:\Users\Admin\AppData\Local\Temp\Top 5 FPS Boosting Packs.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Users\Admin\AppData\Local\Temp\is-1Q2ET.tmp\Top 5 FPS Boosting Packs.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1Q2ET.tmp\Top 5 FPS Boosting Packs.tmp" /SL5="$601D6,865850,776192,C:\Users\Admin\AppData\Local\Temp\Top 5 FPS Boosting Packs.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://songsthread.space/tracker/thank_you.php?trk=2477
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffcd8546f8,0x7fffcd854708,0x7fffcd854718
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=184 /prefetch:1
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13284923632865063084,5658889692166824948,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
      4⤵
      PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
7fb5fa1534dcf77f2125b2403b30a0ee

SHA1
365d96812a69ac0a4611ea4b70a3f306576cc3ea

SHA256
33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

SHA512
a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
261142d1bc88814fab2245b6196950e8

SHA1
8a31b061d56dade77dd5d5e8c798046ce5538c5b

SHA256
5053c982b9b9caccc7a10e52256df892b066a79699a810b48b5db03b4dffdb3f

SHA512
185cf1fe7dd5620a5ca7a42226dba165f208baab49409a4a53ca9321e552873a6ca11a59945016c61e74cb28861ed65df82d11e9db4fb6fb6573096d1c62ea70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
f608380a9c1bceccedad173acc3760dd

SHA1
2761403792341dc79a5d9e2ae4666ea7ef92c3a1

SHA256
24efb80516afffa72714497f0100943ce8ec82d1df7fad857e9091ed319ec100

SHA512
112809ab858d4c6e48dfff03d3bdc7f6d1d813f435b0429a1bb90775eb91cdac97902241afbe7d6b273be316033fe7563365c4bd1635d5e6efda7d394ca0e822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
559B

MD5
092d04a7f406147ae93b30e0bf47c7f4

SHA1
aa17f5982dbcec3b94e2ee23b7366603b061b93c

SHA256
28b64ffe3feb42409ded99047ac32974c5848a3062aab2110d0a404145b0f598

SHA512
2d401c9eb65105f79cab3c023a4bd30b739c11d01ffab47e79e347d6cfc02aa4998db6e699058f2b90a8930c596dcb4444dbd10a31b7df46396da2f8763bd9ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c97b06d0954cae781206564dc203f98a

SHA1
8bb63d98d537454ba4b1503645dc9af5b63efd0b

SHA256
f2975084771752e54d095a04a4d24dec04cac8447e128c58f88ec4e363c6f7cb

SHA512
b3a989f371888756ee7f29dcbf01ac5fa71312a170c00485b6d6efeed216d48d0b4b8ea9da29534ecd6d6362a6b9349f11f015526395d50a6ebb7d4c93c31ed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af5439a3bb99b11a3219471eac579bae

SHA1
a4d6bf8c6bb27f5ad17bb78f13d69cb22e1de809

SHA256
f0fb90d9d57ef1d85a7634f7f3e15e266585b80359bc717b1389cdf5751dcc97

SHA512
8a3bfaad173f3c38729de75c7646d2003eb8f714bea17cb8e5fe3409a15ca9adbd09099b1f106cadaebbf1636be6fd9a77d71132b308660707f6c471049b57aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56cdcf74690d4213e2e7831473bb4f6d

SHA1
d81ed4dafda08bab7d2c4db230ffa95b7210a7b4

SHA256
99956dd4d819a73554e570fcfc1369486230cfacae1233a6c65afaeb49977c78

SHA512
7a0262e940870bcc0aa2424005b66d47ca53b90b538958634a6ba374682a63477e4e6e52e475b22343877b912c73358acd0842a27d07153ed4a0c3819cc60519

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3bca6a4eff2da016338711c0d394d124

SHA1
06d01de79281d39ab2ed7e251a79d745451d863c

SHA256
17ef9d3dfa8bf08273fe37560e1184e7f3d1b0f5ba781c27525b0644f1239aad

SHA512
cef850ba7623718d345b32ab630452e40bd1438aef5e48ee7bcfec455afd13443c820c072223aea5f0706253fd2248c37f7336cda914091c23836779b16061c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
65193905a09f5c9e3543a11493bdccf3

SHA1
b47be7a5908ad6c76814e342b905cf8bfea457fb

SHA256
7306efa2c455e826c61a96b4648ee0c1eee7dd373839ea06fabae2eee345ccf0

SHA512
ea1007cf4b6eb81e17229ce894ba026bb6d54f0186c2cdbba9161e3b44b954c281dbaca9bbfe5c397483cf40687443e07e995e0e8336c866fc7c328e168d91a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1Q2ET.tmp\Top 5 FPS Boosting Packs.tmp

Filesize
3.0MB

MD5
5e2c5ea1532b4cf4b2566cae870c8a90

SHA1
0e69a3cec087855accbd515d009ec5b445355bc3

SHA256
63392a0daf2d9264ff34f71d533552eece4395a7627a9ec83bf805989c690d68

SHA512
24ab71f0ee55928ac40b137d4d55cee425f42993246c33cb27a50a642a420f0729ec108a31f0ab315239b7ccbb16a63f565178ec6bca627c371bc7ca6e7d856e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GFH9A.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
memory/2644-27-0x0000000000400000-0x0000000000706000-memory.dmp

Filesize
3.0MB

Download
memory/2644-6-0x0000000000400000-0x0000000000706000-memory.dmp

Filesize
3.0MB

Download
memory/3904-29-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/3904-1-0x0000000000400000-0x00000000004CB000-memory.dmp

Filesize
812KB

Download
memory/3904-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download