f45bcf726922fe01b71eb17cdaea8fcea57bdeefced3054e118732a41805f15f

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
08-11-2024 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tox tweaking/ToX Premium UtilityCRACK.exe
Size

37.8MB
MD5

08570a753f944196e653507ca68a65ce
SHA1

02fc64d90f5ec3e20e0985f50a3b882569ddd354
SHA256

ed4ede2502e8af6c22df6a697fa66c04ed4ce241ceecdf00ed32b27faa22afe8
SHA512

3592af44e3f31182a49e7cc5d103f5a5637f68feaea9d2a4fb5ae626fe8cd7e4e03556d85aa0a31e92852796d2620a78b6d5bc87dcc786525be6aaaef78f5893
SSDEEP

786432:3zQEQ2zOTHQKTyXjbQEV9Frfy+FYL24WbjNRQ4rX+w71/QnX5:DQ92zSQKTyzbBV91tFjN5q8qX

Score

9^/10

discovery

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral3/memory/928-3-0x00000000185C0000-0x000000001A4D8000-memory.dmp	Nirsoft

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ToX Premium UtilityCRACK.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ToX Premium UtilityCRACK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	ToX Premium UtilityCRACK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	ToX Premium UtilityCRACK.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4896	msedge.exe
4896	msedge.exe
4000	msedge.exe
4000	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
996	msedge.exe
996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	928	ToX Premium UtilityCRACK.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 4000	928	ToX Premium UtilityCRACK.exe	80
PID 928 wrote to memory of 4000	928	ToX Premium UtilityCRACK.exe	80
PID 928 wrote to memory of 2312	928	ToX Premium UtilityCRACK.exe	81
PID 928 wrote to memory of 2312	928	ToX Premium UtilityCRACK.exe	81
PID 2312 wrote to memory of 3372	2312	msedge.exe	83
PID 2312 wrote to memory of 3372	2312	msedge.exe	83
PID 4000 wrote to memory of 4320	4000	msedge.exe	82
PID 4000 wrote to memory of 4320	4000	msedge.exe	82
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 1528	2312	msedge.exe	84
PID 2312 wrote to memory of 4468	2312	msedge.exe	85
PID 2312 wrote to memory of 4468	2312	msedge.exe	85
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86
PID 4000 wrote to memory of 4796	4000	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe
"C:\Users\Admin\AppData\Local\Temp\tox tweaking\ToX Premium UtilityCRACK.exe"
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://toxtweaks.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd11023cb8,0x7ffd11023cc8,0x7ffd11023cd8
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2028 /prefetch:2
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
    3⤵
    PID:880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
    3⤵
    PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,1371043790478268227,10704488810818972749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
    3⤵
    PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://toxtweaks.com/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd11023cb8,0x7ffd11023cc8,0x7ffd11023cd8
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,18418274203863478795,17633249085889777514,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
    3⤵
    PID:1528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,18418274203863478795,17633249085889777514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://toxtweaks.com/
  2⤵
  PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffd11023cb8,0x7ffd11023cc8,0x7ffd11023cd8
    3⤵
    PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\33473f09-166a-4155-8c88-5a6565afd171.tmp

Filesize
8KB

MD5
ded656eb94a1f124c00051c01515c760

SHA1
b68f9db4e94562065fc188f76ddb9618c152edb2

SHA256
f4c8172b185b29654d99616cc52823513cf72c1564d218b1907682294f6de390

SHA512
1b208b387f2649c8f269c9c627c1851537333b569a92c612f567fef5247a214c8b628029f710450f51958be6c0e53fc26ada6c54ef820eb8f6359cd05b7f6bc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
17KB

MD5
675ff56eda9ae73f640fa87814e52cde

SHA1
9bd263c7df549aef43732744ea206c57cc3523b5

SHA256
ae57d8b9f66ab7515bce739bcf396038f119280c874da00f8b8e19ae57fa6655

SHA512
01018d577704e481f9e8e5d7978b271fcc7bb3faf66c6679c16e12e3814a3e849aa945e5971bdf76fc3b56ff0595778749000677c095631f5142d8bb6983e6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
18KB

MD5
f16da84be1202d0699e048e537e091b9

SHA1
388696b703022bff832b4a1f4a7c3214aa6bd92d

SHA256
fedf77fce44d1ad7be6b23ecebcc7aac1cc402095dcb56681d98b3cfd6feabab

SHA512
406a99fe4781990744d531c46b3e0a9188ca7c815aadc0a9aa677badbd145efb0cb38a2f6e432d5aa66fb28e7af2c2a33d67383e32af7ba154e1f93ceb1f8d9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
48KB

MD5
d55cc15b88ecb7f412069d06e16a37b6

SHA1
1a5f446dcf78fcd5fc0937a535ea86baf3a2885d

SHA256
fcf5fd94a3db59457564ec216447b292bc74067c9f2189b0b2d16746cea6f730

SHA512
1384e82e7566a801f36cf8dbea60b1b34bec6884d19126d158d1b651a20d1dcc6cb30101c72bd3cb222e9f8b22636857a78990ab7920b5b9c1c3aafc1a8f1be2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
fc3f2aad49389f50a26bc737ffbc4038

SHA1
2e802979b3e574cf0e9f61fbda32c749515eff69

SHA256
9e3eee68a0302f3b0dfdc0e2d898cf239227f660c7e5a46246a39134193bbdb0

SHA512
9d944a745af3069b0f2f48c8ae0b5cc3f6a5efc28e7f6cbac01dcdf409b97a3cc45951dccc33150e4cee5f44410f6cbf33607fdd35555ba4e124cd47b33017e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
93KB

MD5
9bde36fefc046788cbdb005c35bf27dd

SHA1
f657d48bec11fc3b8499d694ef8d14cd65181758

SHA256
0be06e07780aa24cc3e71a5ee188a2f565f0cc35848d660363f74239e22a72e4

SHA512
7343275ec09cb20a1a2a4a88a8a6497d4c407f0727d13e7b1816d071721fef01b70c61f463ceb0ab72ebf646a96453f6350f0daceddc438b9080cbe8f82b1d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
177KB

MD5
b5cad4f0a11768848cd75d6c72695411

SHA1
a3e2daff00659c8a5967306512bc0cc019b6b039

SHA256
dced4293844836837e8783050635c2a5743b65649e18e42f48b75347ac06c396

SHA512
7ee5ff007ec9ac3423ba36c032e07ce0d2b3740a9407edb8e8ef8bb79b530ac9573bf20dadadddde4301842cb6ce4401e706b1252c01e99bba3bf57dac985453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
154KB

MD5
cb3aa59edde7be65c336ddbfc2954c20

SHA1
1f242feef06c70ad6ba15760020e3b0f6770a623

SHA256
32215603f05d79e46b5c5c97c4318f78a96402d45c27595a27432eeafac376e6

SHA512
890a275a25050556e44f7b201aa2614555f78d0a365b89064ac4e93de06733791bb92b14da7853e12039bb575cbde4ab0f82d297c62b6e59fb4a5c9d8e766aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
60KB

MD5
f70baa579d763f4bc2df9911cd97f38d

SHA1
cb6ff1124c247215383843cb88bf36473aac769f

SHA256
69c6971720ae95f2ce455328db7afc3b142f1c2861abe1048a48c6efe72c1816

SHA512
2b320b07715c8326f870a649853aff109d1bc3fbd4b7e79363dcccb79a42d3ad6302e56ef95d769a3a37db7a5c606164cc2098f6d3e4354d04ba2b197dbdf775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
afa125d55a150f40642d82baec12fb62

SHA1
4fcd617d4b45e3a709f09080bc47bc4a41d01af6

SHA256
b842930dc611b973927cb4a2688ecd365387cdd69c089e4779820fcbd4f30afb

SHA512
98731e3d711633318b29972ef300f892238e2d2ddff38cd9405f6fab8efb1260694667480d153c3c9dd1a2e86e9be0f9f3a9d13b94026f2cac1f3276749b033f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
081e7cd2f42fdde0b0bb9b064bb38561

SHA1
bd54038a568fae09b70be9fff18bf0a0c63f4fa0

SHA256
c37ee73d92f3a1050d017ae6b72dc5df4af77c99d84aa086f78c9f70968ee6c9

SHA512
8cf4f2c5d66cd950b4f3d1f248ebb1baf6b191ebce3c156e56d6dd52daf77dc561e612355c328f8f17d48033727c478c4561435f61fa7164bccf49d5a211b9b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
693a6020f71c7f33f7bf22c73581bfdf

SHA1
630f3b00f338ddd1db73da62ef167e91fb89ad92

SHA256
6bbd1615fab1d5ea1d46029b6f7bda51cf3884534d836e85c1db44dad7768abf

SHA512
56235496fe1690a872ad3777913adb5760a49934f34e8ee5f582a1d234e15637297ff9e962b7ef3d8b875fcfa493ae278d862d37bb891014af49fe9121726542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
78ed463c68337cc57f3448490fcabfd2

SHA1
2299cf0933c6910cdd3704927b7bfd518272b7bc

SHA256
0aec20c0c0e5ba0acdecd64899bc0460a16e95e1998ddc18714778ddda8e3dfc

SHA512
8ddf03adf8a0bcc05f10b0750774d3da0958b80f322950baa6092f0487c49e4a5284938ec0bcd4787d2f4e069a383cd587752b03babed63a7b82b81fc02e569e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6e86257c8aa7f49995f258310ac5f3ec

SHA1
38b802b11af21aa95bbc804d18f3e73a05b865f9

SHA256
f956e8c738779bf864222146a57dd3e62d7996116613c0ee19c8c23c8155698b

SHA512
472f6d44f621ef8192003553d57d96173fbfa8cfa479f23d859c2274eed7f6cbbe52c9b27b6e86da7f84685e6135c91af5b7d21dbb13003fc0cf1929b671706e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b3439e6f4b490d570e6078e555d8d41d

SHA1
7a2a008446763747a9361f6522b50bf757be7e38

SHA256
66ff1f92396a8a95705d8d75012c497b3a45326d83020c83595a5f4f1966344b

SHA512
92723605962ac904e104b07b2eb2583517c560fceb5d41b33560622c296f9fabecd6c1c23349189b08fbbb48485ae977135d18e12d6b5d63385a1e4ad23e53c5

Download Submit
memory/928-9-0x0000000074C20000-0x00000000753D1000-memory.dmp

Filesize
7.7MB

Download
memory/928-5-0x00000000078A0000-0x0000000007932000-memory.dmp

Filesize
584KB

Download
memory/928-4-0x00000000085D0000-0x0000000008B76000-memory.dmp

Filesize
5.6MB

Download
memory/928-3-0x00000000185C0000-0x000000001A4D8000-memory.dmp

Filesize
31.1MB

Download
memory/928-2-0x0000000074C20000-0x00000000753D1000-memory.dmp

Filesize
7.7MB

Download
memory/928-6-0x00000000077D0000-0x00000000077E2000-memory.dmp

Filesize
72KB

Download
memory/928-7-0x0000000007840000-0x000000000784A000-memory.dmp

Filesize
40KB

Download
memory/928-8-0x0000000008020000-0x0000000008234000-memory.dmp

Filesize
2.1MB

Download
memory/928-10-0x0000000074C2E000-0x0000000074C2F000-memory.dmp

Filesize
4KB

Download
memory/928-0-0x0000000074C2E000-0x0000000074C2F000-memory.dmp

Filesize
4KB

Download
memory/928-11-0x0000000074C20000-0x00000000753D1000-memory.dmp

Filesize
7.7MB

Download
memory/928-1-0x00000000006C0000-0x0000000002C88000-memory.dmp

Filesize
37.8MB

Download