hxxps://mega[.]nz/file/KqBn1Jrb#Sj9DGB5jlE8EP7iaHEoaRL0yJkBm53q8KJivbyeR94k

Analysis

max time kernel
373s
max time network
366s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/KqBn1Jrb#Sj9DGB5jlE8EP7iaHEoaRL0yJkBm53q8KJivbyeR94k

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
1648	msedge.exe
1648	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5284	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5284	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2540	1648	msedge.exe	89
PID 1648 wrote to memory of 2540	1648	msedge.exe	89
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3676	1648	msedge.exe	90
PID 1648 wrote to memory of 3716	1648	msedge.exe	91
PID 1648 wrote to memory of 3716	1648	msedge.exe	91
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92
PID 1648 wrote to memory of 5116	1648	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/KqBn1Jrb#Sj9DGB5jlE8EP7iaHEoaRL0yJkBm53q8KJivbyeR94k
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc78d746f8,0x7ffc78d74708,0x7ffc78d74718
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,17089497369540234662,10630622908129955853,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2716

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d8 0x328
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
8745b924c9cba6c15b58ce6fd7aa689d

SHA1
dfd86a85a1052f20a4567523d821dd3eb9e047a8

SHA256
4891312432d0fcec47765503af5d40c829357e2ad8a743aec716733ffec883f7

SHA512
9574a44249beff364db7ce7fc543e585cb44d5fbc16fc048dcd68bc0dcfa889ab6595ecc60f41a35cc69dab6e911360981e97c14a11841e16982b84f0cd32704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06d54f367be8856bc96f7b9229752fb6

SHA1
012aa7e2a78bcba6c39925179673733655d1604a

SHA256
da49124a3a3696efdd657f61315611f88a34a7a47dec2f4b749f14cac44484a1

SHA512
03fd2307cf5175b7e204833e43b1fc5ce69b7ce350c2ea0509dbaa0456ba89d2738094d34946912f21e2d23bf41352b6783c347d913f935272399ff6c42686b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b138d6967ff5dd31c3d65f1c14171eb3

SHA1
1fd1359e76c2b02b80ce58d2ede177db550e21eb

SHA256
4593fc51e0f7d2e383b1adc62973d87b8bda7e405ef1bbba7ec7f9b15fd288cb

SHA512
a077695f008b8c9aaca819921543220bc017997dd8510634762a9f9b640aa05752c451bdd27b750de2a23a90fa6a3ce57c97ed84c15bacdf4366bf33f56bc5ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f6b90bdfbd0f6179cc94f59d8e1059d

SHA1
d9edeec43aa757024253ccfeca0874db6e7d7f52

SHA256
4937f6907b92cab391683bb52c33a64e89977a18159a373f3dc7da7593517167

SHA512
ea705540f8cfd664ba96d31b6b0d6dfbfc230eaee778343f776fa8399195a61a2c1f1d659d267b1e403fe8b14a77ee870e495de7cc8a877275d992101cf447d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c3619b2e935fb390d8d95f9e174eaab1

SHA1
edebb746fb9f0e84f82e28dc6c781aa56ae48b79

SHA256
9a41260b789ab190e04f33ad1457deaea195cb7bd6ef2269a9e276f01b5fbf58

SHA512
39355d0b9106032f5314f3084f4cde07ae2bc688f41c4e699a89c8c8ca581fc6cc4ee3e87486f59eab775655b6d1f7b95e2817137b9aab83a23113713c2fe498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579d69.TMP

Filesize
48B

MD5
28da00b5b998230358cc4569eb6c6af0

SHA1
b904aaecb5e34c8d17f751964ec61603bcc2194f

SHA256
d7ed3b650a4cd1351ff3a7237ec82e9a521c2e146eac3e598a39cbcf41807c74

SHA512
aa74e44cdeeb79d88e29c0fcdef192882e890c5df4b31ad0411af7db51a9afa215d92a587aa721fca5e219a133a55170d4deb0e868cc10c8e03762caa6775455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
773511e64c1b2406cbc3385176954fbc

SHA1
af3c70a36388fdf8f71d2462b88fb60c1f722592

SHA256
61436387d35c1843e3e77f991138e1f10a558fb7923fa56467319908e22e1681

SHA512
07acc598bab75f9dd694842277837d62620c83ec0011d343c08d0c56fb8bf7efd8379095ef2ae6e4a33a4c29d134ac8b6fff7abc4bd7ddacdeb37455538cf5c8

Download Submit