hxxps://mega[.]nz/file/cF9nwCiB#JDFt-lmXs8k7zIQeJI9vuLosMq1AWsbUrblyIR_al3g

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/cF9nwCiB#JDFt-lmXs8k7zIQeJI9vuLosMq1AWsbUrblyIR_al3g

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
2804	msedge.exe
2804	msedge.exe
4864	identity_helper.exe
4864	identity_helper.exe
3136	msedge.exe
3136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4896	2804	msedge.exe	86
PID 2804 wrote to memory of 4896	2804	msedge.exe	86
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 4956	2804	msedge.exe	87
PID 2804 wrote to memory of 624	2804	msedge.exe	88
PID 2804 wrote to memory of 624	2804	msedge.exe	88
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89
PID 2804 wrote to memory of 1288	2804	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/cF9nwCiB#JDFt-lmXs8k7zIQeJI9vuLosMq1AWsbUrblyIR_al3g
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd592546f8,0x7ffd59254708,0x7ffd59254718
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4044 /prefetch:8
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7784004341538483470,2399612783273489499,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1456

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x300
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7a5862a0ca86c0a4e8e0b30261858e1f

SHA1
ee490d28e155806d255e0f17be72509be750bf97

SHA256
92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b

SHA512
0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
9a0c0be9d0364eddd67c590462b44db6

SHA1
00716870420d42a17e791941845fb1943ee07c92

SHA256
7c4cd0a82d2668250bd99e88308d183543fdce7a419f80eb4bac00f9bcaf4329

SHA512
3f9430ef25e189dcc7b3cff529677d52f783210b62bb564e00813ae8cb782924770aef2d2cb7231cefe584e7fa43fa95230a03894f55e2136f24ea94130d68d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aee775ff178819e8bce79f71d6785b3c

SHA1
ff4ff8eb2df6588efbf4149b2c966b3115b1ff65

SHA256
48eae8dd0ee862ec25805044083d5a68756d48fe3b11c81e81c2d35f839da55d

SHA512
3ce8479e802fc2164bea81291352b7c3aec30efae34495ecbca2b2d50be541a619d94dbc3aa472e1943e87c542b206f4244545e156599a085ad44a4ef373186e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
52ad0f78ecfd38e731aacce85925848c

SHA1
eddfc8231fd619b2bcb343092622a38d16e40781

SHA256
3729276338475c0abecbd321701ae12ca62c55d718dbfe6218f3b09765ffb1b4

SHA512
eaf53fe08dbc747b2bb6d0637588d1333654187467e159491a34d67232101cb145bedf4d21b0fc25c8049936f97dd136d230e76ff910ae09e3f0cd89642a75fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f9e3f78ee2cafd535ce74ef226f6b35c

SHA1
7fc4ac820c326ec0f14858e389bab46a891e8128

SHA256
c654b81255ab156e2bea51a877c12705c009e5976be0f9d79df34e498fe2ec23

SHA512
21d3da508b8fb4871891d2ee44dfb50d385d978a7f1f2c8e226f6b6c7171a6d84853acb54783b4366480acd72e9135e273111fd4563f2fbd404df9d212778b5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e4ff96a135bfce88b0792a74ecb05bb1

SHA1
203b916c04097dca4daed2bb2adfa9d315f3274b

SHA256
4780938d3d9df3d0ec08a1375f76783e5db2b6a2b1c7e4647675a38dd872b0fb

SHA512
7565c5018cbb67c153a1bb8e680441fec44e839b940fea1350689e3de0c086e5a6842442bf668d7f9c9c96109984d103fff6e14bd09db62569a70d94fc25bf41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
52826cef6409f67b78148b75e442b5ea

SHA1
a675db110aae767f5910511751cc3992cddcc393

SHA256
98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb

SHA512
f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c38f9738288425b97af53fa5f98a0a0a

SHA1
1152b4738aed8e80ee064a04d858d9998b50f5b1

SHA256
b467fdb48bdcd49a1b86281a6dd68c66ed2a2fa63b556dca3bbdb81f60bb9f72

SHA512
f6eea0a3c9b33ba0af35454802f70a3ffc2ccec173955ccbbf8fb2c951a34e4b4521a9e34be8638cc40f78ea989e795e1ff4b4b9ddc44ffd5ba30b1a83434a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c796.TMP

Filesize
48B

MD5
c3209d1b3289ce7ccacec32227fdb8c2

SHA1
e087ced3093799a19788a501711c7130cac272a1

SHA256
676eb4e31a67c7adb45f95daee07d84a3a2e239656f294bd91bf54f21e795dae

SHA512
afaad9698ecec6627ed19013d25b194badd3b60c6cefcf2dfa68f106918e3620c4b65fd81deb68b38e612956004ef507db8aab7de0312d9f4140734f14c988ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
208f0030a6c7503ece753722e6401a46

SHA1
7cb65a8517d22c4fdde1f51686f3e9461b33f177

SHA256
bdbd32a5139041135a235cab350815942ecbad229a8b8db91a5d27fd6f482618

SHA512
0aedb2de16042f0d0b2ea566611dd9ea192e50b5f7ee7ecc8000875a56b16fa00cad71d3a5bf1f23e3d90e79fa8619656f376c0e57ce5feb1d505daaf5857631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
542600b72c4cad899a623e6df67e0ca3

SHA1
8d7c6019cff858acefd7c998bc3d7192ee9294ca

SHA256
e85cb8ccaa3d274a1a1f1c96622b66c62928d12b0ea38f7808e0e642f67b714a

SHA512
0b56730f5209f3e308f697de5cbd44f33990b8a87b08e2a058132c144b5712465bef022ea95cc59fb52f99a8ee1d1b4c35875b7ef70030bf487982f64a3dcc15

Download Submit