hxxps://mega[.]nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM

max time kernel
406s
max time network
408s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
21-08-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM

Score

6^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NexusFN.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 60 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 50003100000000001559a11210006e65787573003c0009000400efbe1559a1121559a1122e0000009da902000000020000000000000000000000000000009fe895006e006500780075007300000014000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "3"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1735401866-3802634615-1355934272-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\socks4 (9).txt:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\nexus.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\36 Skins.txt:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4692	NOTEPAD.EXE
1744	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2212	msedge.exe
2212	msedge.exe
5736	msedge.exe
5736	msedge.exe
2568	msedge.exe
2568	msedge.exe
2376	identity_helper.exe
2376	identity_helper.exe
4512	msedge.exe
4512	msedge.exe
5340	msedge.exe
5340	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
3932	msedge.exe
3932	msedge.exe
3056	msedge.exe
3056	msedge.exe
4528	identity_helper.exe
4528	identity_helper.exe
3256	msedge.exe
3256	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 37 IoCs

pid	Process
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	4400	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4400	AUDIODG.EXE
Token: SeDebugPrivilege	2848	NexusFN.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1744	NOTEPAD.EXE
4692	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5736 wrote to memory of 5648	5736	msedge.exe	82
PID 5736 wrote to memory of 5648	5736	msedge.exe	82
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 3052	5736	msedge.exe	83
PID 5736 wrote to memory of 2212	5736	msedge.exe	84
PID 5736 wrote to memory of 2212	5736	msedge.exe	84
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85
PID 5736 wrote to memory of 1564	5736	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff381f3cb8,0x7fff381f3cc8,0x7fff381f3cd8
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6740 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7448 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,11894115487599691744,11861710374452226026,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6476 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xe8,0x10c,0x7fff381f3cb8,0x7fff381f3cc8,0x7fff381f3cd8
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,15534524636886419745,9282354895794993880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:1564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5136

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nexus\combo.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:1744

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\36 Skins.txt
1⤵
PID:1908

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nexus\proxies.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:4692

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\socks4 (9).txt
1⤵
PID:2260

C:\Users\Admin\Desktop\nexus\NexusFN.exe
"C:\Users\Admin\Desktop\nexus\NexusFN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9828ffacf3deee7f4c1300366ec22fab

SHA1
9aff54b57502b0fc2be1b0b4b3380256fb785602

SHA256
a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7

SHA512
2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
33283e35e23033332d4a139e2f65d375

SHA1
15329faa7f816fbbdf558ec9bb7d47d09f0e72e1

SHA256
49d57921366b017b08bc13942d5d3f0f146167cae92058fd13289b8df1cddfc4

SHA512
36b620c0813445358143c54bb06da8dd933b8e61104fb34cb9b5f03a6c9133a195e4fca6ade1b79ed93c62fb3439f4fd5df40bae8e9aa4c8fde72e17a03079c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cc2429a9fdf1ff1b068b456a6f9edb5a

SHA1
ccd3f60cc81c69bc5edad4d618e10e601d492802

SHA256
89b660e0941a7b9f25b7be9bd3e77d35b2121f6d0b940d46851b8ebc5918826e

SHA512
8ad8c90e98833f9bab7efda39f0e3c343fbd36aba8c54c53a722e88ab8c79a6b12971171ee42332552b107e84bcac1342d609b389f8d34d06264b2a73015a9ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
30KB

MD5
d1ac99f22b8d1149ba74efd60d894819

SHA1
29a846bd46ecab2c9fa87d1a86fae6c08e642b70

SHA256
4b87080fbb2db7330df4068005d45c3339a603f29579731eca94ed8dfff88ddb

SHA512
67cf99b90dba66196ff724f2c4d6fba333d88cca9cc42312530973f2f145cc24b3669178ab7c32e254d957ff84078edaf4fd9918ae2631f75e5cbb2fe10cf416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
34KB

MD5
118ac39cff9e828be993490f864266ff

SHA1
ae5df00b1ffe0cc28ff84dac418a866540267d8b

SHA256
4a81760dfecd6b4890a7ad37ad772d15a7dbc8cc409fcb48a0501ee75cd55767

SHA512
88272ad598555ff57f316466c7625f53b07bcc5e65f11f44573712dcd6144a4ac2e32b11c7547b06552168299b8b7b01dadce6dfb92fc99289bb9ca562b621e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
128KB

MD5
83e2453b52c74c6ad9b525c49a0abd5a

SHA1
a0f8f6b3653908d7cd5c616ec8371213cb9efc03

SHA256
b533a8fc87e367e2ee0cbf426f47c8a4b75a4ca52c001259a52a1f06d3bd2d8a

SHA512
672d479e2fe471c854b9b360639efa6278fc713bddeb94f5e392c407f035a13b2b27f851b0896988bec71228845dd289e6886cfeed7a625ef1dbc53c3540da1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b3060bb316e765fc4cd522d0986da625

SHA1
c87ffa30eef7bd4844ae02363e63531aebbb295b

SHA256
616bde1dfe11d5a59692147ddf1cb1577bd6bc08341044eaaf0f9693613b383d

SHA512
cc31143c27455eaa05e7efce62813f968b84ebfe77b13d1eced30460aa9355d2336d7d85635dffc3c2c1c7593c1afb7d91ffd964cc6a8633b9e956dbba04501c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bc64e1632b152ee6b6fc5518c395b46f

SHA1
0cf9fb7effe181a9bb3c6354ff18f80285bd45b7

SHA256
e7ba92c1ff03e47c69c18f863b19ce1ee2db6adaf37747320a2c317e993d10ef

SHA512
36ec16e9902edcf3ebb617dee976a5800ad09fdab0219bbe504d9610cf5b9a7f46dd51564aa0e4a52617f4b3e7ae64ca8da3f6fdafb9e2ce7268659a9a8b3c80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
046c63bb9b000ff2b371452fbd70f42d

SHA1
9c6c758999858b9902fea4df3c86736201f0f90f

SHA256
7b5040b819738c4fb9fc69be289fb967ff20d6de40f077b98f95cc6884aea4f0

SHA512
2aaab01a3ec4ffabc079c4d3af637d5cfccfb010ae4deaa819a183f9f050be069453deb7d30008e725279e6a78ba8b259a5d63f4234c0c763db65c2968d3574c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
44404b45779b5854407d3dd480d03f8c

SHA1
f67d9b0f4c64fa44724c55eb2398f58f6bb83d31

SHA256
1e8d8aff13533009db593b8d2533a0a6bd7d6ec5104c3f2b339be602f39715c3

SHA512
82226e03d3f63a658af5a9f0e5b7113d364c67aafb30a8adedc2f4681819fc68a00df153463b19ba112d79fe51938c5ca4cf507b0a53f0bd33ac68e0410548a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
c0aa2d82d2c4c4a52aaa603fe061fafa

SHA1
c3f103eeca49979f17d91eecf6e656f6476acd2b

SHA256
f83ab147b9c63962f04a9b74be92aa38d42cc0917daf4b2c660431d24d59b0a7

SHA512
8663333158cdfa61df3a21db84773de02b33600301a9de996bdfe61e24f706f6414e56f6d20332c1ef59560c709bdf8f4f9ec25b270d911ce3590699009e827c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
e5cb22fc57fc046b639937e4128f2f21

SHA1
f9e467ce382955038d72c8518412456b603ad61a

SHA256
d687ff4653b1f3a27ac069e8bad54d4c5017e7758d41a56a8334115f3ffc4c2c

SHA512
f6a74947d9e63c08095ae0054fb90bf44775f5bfd5d1f484af920486a91b0cb2c53a8f1b92d025e844da01155794ebb2ec7673f598a1dad90063a03d498c3b0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
e5dee1581ce080551f1cbecbd99456d8

SHA1
26404436f1b45b73144a384bf4105b9c79fdfc75

SHA256
d18edd661ba109ce77d74f26ca785df17b3838e0993cdc1e3a343d210dd3708e

SHA512
7b44f1de3219400008f32a4fd8f151e922c8c35831e92fd7c4471c47aac3cf854655f1d95c62287144db995782d780ec1a87628384b34e72395752b4c8f8034d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache

Filesize
2KB

MD5
e91d6b7946c2896d4caf021728960768

SHA1
1318ecd4091c63d5c448414c9ad1a7e2ce33b7c1

SHA256
16598b7ea71b47f7473714a247273e04650d8c73e6b149567bbe6c58bdb27e12

SHA512
427eefa02c6739bd06fe5e2f602ec718822657955bfd0d01340dfe016e09b25cb1320bfb0759366319038715e1242cf63f8e9a407c24e4e98d39439373262577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
328B

MD5
2b238ee16d5e77b539a043d0f990b1e6

SHA1
89b81bd72d0aac0b35de5c7acdde315e2516b377

SHA256
d65a7baa6d7b6723b413878ec3e6183eaca01701e46f9500521198e374fa9460

SHA512
ac15e7e767e9d1e4068d2afd644075a7a0aa06a51ef8135641e3cea61c5026bcce18e91ec42ccf0d93d38faad1b1c589ea541e7f5f07c332edbed0ef4eaca7f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
258B

MD5
2af45267beec0d905b81baba591e58e5

SHA1
d7ebfa1fb16ecc563901f0fae767b6ef7f0976fa

SHA256
7e8a74a7009899f8042b98847e1c8d967987bd2f323267b881dc8b0c0fd559ff

SHA512
614f0f2e87ee3a9b05c22d6c420daf601e9a908a7724f4325df401cc01021d1106c71867c0fc5ebe9829c48c046e681ff446e7bb94aa4b04d246cdec1ede4c7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
19e1d3e6642a0d598491db22995a9e73

SHA1
f7fc30c57e82c6ac5bbd99904878c26de58f777c

SHA256
a88cd826cbef335ddc33a4ea4843e2eaef3575797d5de72647fb82dadd875b83

SHA512
a2ecfef8979272071b28815ffc316ce64d926fb5f5214582cd0994c5811b7fe5497c00f675efddc106adc69891e39275a637c74a401614c1a50b4e8105f31822

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e4cb1dee75dbffbd5af18690a4109be4

SHA1
32756dccc7840ff2302af117e9bca6fa6ba3ed0d

SHA256
e0f94996a1d19e8cc06de69cbc229aa20e08208b351be11e043e960385f75a96

SHA512
1f84424df91718091db36e5622a3f3c70378aea5c776eae5dd67990f7e8de32235eddb3d144d2ddb9c4392c16158a130902bf7968d443b13e82a85698e1b8b38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
182c193605ffe2e3c63ce60a1b993e39

SHA1
d3d148b879fe8f44a1c03fdf19c8adeafeef1013

SHA256
d208a4a399baad89e97f5ec194cfaa541bfabf55f01cca2a4e20d210726a9ddf

SHA512
a870ae9c324b96243d108f8a805d9975ad9d675d73314ba46b98efaa5db73b9bb972ee44af2ccc55fd927006e0d8e7c3b199de175229c03d2ecc0d5f7e290bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8b683d6f013c40f67e1da3a2b103fd7

SHA1
ca656464bdbf12339679576a26dc0a11f5677971

SHA256
40cc20ff85dbba0c430a4236f5c8808aab4ee037c15e2f5514bfb670a8fc510f

SHA512
e4ef307cf2a85db00f61cbe4abce7e35fe2506dbd5a6de4db914954a7b90402081b0a6eb65796e4e789a31efd006560713fdefee04b1ebba32e2a94a6521a3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63142aed7130b5ec16c6f177bbc0f91c

SHA1
4a04a6befe05f1d1e76d57c7323b4196e206badc

SHA256
a3e6e55926fd5921f57b943184389eeb0a71348866d56c26b11a2380693489e5

SHA512
920da601fd8dac0e63f22f3a81373d6289f71531850172446e8c1ef15c10361794f09664a3db27113578d1f28dd23496460db1d8ae666bf362ed2bd6b13c3c06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b9c2be4759c846bb8ffe2071fb7ec3de

SHA1
5718477efb9880b401c922783d038de888958181

SHA256
9b878eec8de1509a66759f9c168c6eba23f5fa868fbd02f16f7b28b4aafade2e

SHA512
93f56ecdc66eb9a35ad306b7f8241343a9b054a10c04b20fd53e71cee3fba532615ccf109b211db7100154f2f212a063b1de74a14ad5f31f2b43bda69fe98290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f5d98faf539e424b2d7b8f1f8418b69

SHA1
f4e9e50475e4af8a69a59cdde8c8749b7e58731c

SHA256
f4c25b32253b9d3f79fa7d7a9b501815435e1b66a7f082fb56ab5667e15d8e06

SHA512
1a49ff57a93552721b945e732b8c0a8d2ccda53c6ada20e0b07d8bd0a6484a997b61ca5d47c5276ae8c58a68b2bace1c292141dba9eee36aae551eb3405b192b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d3149c4c465553714d3522c28c55b6c

SHA1
8ee8254edf4780045ca01d053f3b7b8b56cfc3ef

SHA256
54a0cb7539672575d8eae503abfa4e48e5bffec867179f3b5402aef457dccb4c

SHA512
b79effcb2b57d5de509ef0619315faa43ed54eab807c4d9615d92d6f3f74ddfd5c89acd165238607c104793777b821354072a0dd8938e01ff7bf6b3009ba8b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8994041b194babb9615e049982f4ec8e

SHA1
7a46fab94b9d3b5f5035a1d2c8db54af5ac10d11

SHA256
d7d2a73b3c3d197db76e6f87b03d3514c153d308df542054ceb69587808b16b3

SHA512
7fad092a061de3858635afec9be82509cddd231d3cc2e074fc872db82981e2cc06edf3f82eaa1737a759df560ce65f1f6b827dabcbdb74de9302b6dbc3664488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f19fd0667a25c0cf9d11a58131be26a4

SHA1
770e50c9f9d86332452c1952d1bcee834fcfe597

SHA256
122ee67a9883b130e4bc13f525eff0a2a31edd24315be4ba217e4981077a933a

SHA512
650d594b14a2f6745f6e406d43fa2554d526155489af4734f1bee952d0ca515fafb0e958b9f71a6ee402f57e5e411ccbd9b81d3923e480e0f770176afdb675ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e91f36f997edb770629feb0c79a57d90

SHA1
b2c49049d249c62f1031627d73f377bd14b9355c

SHA256
7e5ba7194877295b732fb8282d60b3fbd71a8a3eb80b92c9a7dc8df3e9a69e5c

SHA512
b7f2824871fdd26a46fb7d44353fa71834ff6773578a0ac81ba73f0c28db955ae3edc521d00bb9e846d4e5e0104d8139120a32aae46bfeaebf15ed0c5947f985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0c9d0c959016d481c6fd90ce2a4e3c4

SHA1
8e59d5a8fa04b30c355d6ff63144244c95fd30a0

SHA256
716b4a6b7ade919d5a3bd26ec2be41f93888d6f8a09768a09f4e250e27042cf3

SHA512
12b1dca1d736ab935f2ebf6fe5e37c827db5421ba45ff02182725a634c326c0ad5af47565b721914bc2a116c90ae1440abaaf9275630d10929238ead003cf4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Filesize
755B

MD5
83ef42736ec4fffbe02da129f5ae8c33

SHA1
5c2cd095ca37f12d421a006cc133de2c91cd8a21

SHA256
9c6d76ded0e9ecc13d732be7395f85d840a76c3195d4c6c23a78fc94a5277dfe

SHA512
4ea2f861a234264d4328f6d483f3602b808b50b8c9517df5ce5f69bac1f9835baebb5a88b8d3ca0bf4d08d6a5aef7aac51399916d51267051e851a642450612c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
295B

MD5
7ebdebf71b6624e29701b85be38d3a54

SHA1
38a95cc976600173f9f6d9092449b790f795b5c8

SHA256
bf91a2a10cb5bfccfedee51eb10b8b4e8ae3b217cfb3446ca2a03c863a63841b

SHA512
5ef28aabdbe3f844d6a834adf3005c6cdb1f18145bb8b4b0e036157b46a8c70f98b3b457324969860aa00f38801f6bbc950dc8a10fec332716daacb245de91fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b6b8d3773b8263170ff1102796528df0

SHA1
84341561219fe784ef44b699b4107981c36f5d3f

SHA256
e5974ad6c347f61743faa10d82cdab3ce79ab2a313c774b4a86808329e66fff1

SHA512
dfeb8fd53600d16323a17771e4c1a599bbeaa42f443b9bcce6d68158ba6c09b90f8d9713cef93b6575d6c489584e107e2f6258e294e8bb9bda8cfc066c5ad93e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d68a.TMP

Filesize
48B

MD5
f931eeef06f349a9b68abd141b1d1af9

SHA1
2d3c209a0b7070d028b88cde6a171cda8e3c8316

SHA256
20f5998ca210011b89e4d0cc8a90fd45ea2b63e70d839b509f66188ec47d59fb

SHA512
f0d9d5aa9c416656fc9885afa07c93701fa350fa85ebad7dfe363fdc425fe2727d3e10a91fadc3eee1b5f7223a4c99e253d1c9b0b945cba173fabf05500df6f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13368680287363026

Filesize
67KB

MD5
d9411f929ac026198beee7b4b5872a75

SHA1
aa5028c1c55bc1677f177d04665d03e71aa3ea90

SHA256
1d9db3eab2dfc3bef686bea36d1023994d4a0ed908100e28ad924e6b135b76c6

SHA512
6cd84b78c662e87fef8b62d6f14035d5c6cbdb87e2828c3dcfdc27be88c0864ac0e66282e1319b6ad35a801847dbfe1a74c4cdd61995f95e57bc6627565bb64b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
256B

MD5
dba1f092b6aabc64861c72f98c5ac422

SHA1
fc00b5397b67bde6b12b758cb86fac0eb91e9760

SHA256
c529272c1bc7a3c4e40790f8310df4cfcabfab2c53b2c2a027f3ec6113ee6854

SHA512
6ce2788a9643257850332d02784e07b668b28b7b17d1107cac54089d5293db9fa32c4f16e37eaa8880390e0bdb80c4b9d1a84510df4ee684279f21852eccde32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
7346e3506f44d9f3ef8214e220a76af6

SHA1
ad9f16d7ff1a4c3dcf0b561e07a683efcaaa035e

SHA256
f581a49d2ef9067bd14754bcc4c7720591dfb08a8bb8607972805c4f7082e330

SHA512
f743021067fc20d502b628eacb39d8915f2feee918eb645ab801c804701047196eb571630d6d8561f5522b55ba62bc92d42656f3933e480f8aadf40fe48fe4c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
95b8e64618d7e71aa8c242ec09c6eb8f

SHA1
416465f8fe39c0dd7fab11b867c167a400797644

SHA256
b78736138aa0a741488959e7faa8d46e56a1a35d74bbb63516c66b5516ea87aa

SHA512
fe21aa2127466cba3ed101ad10de54589a7efe4cb7658608fd177c8bde634fb6a8b9c16f04dcde64311164c69a1c6bab67c4a2f5acd5cb9fdc4953a5a699c7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Filesize
20KB

MD5
42c484b478b3286df63f096e3359736e

SHA1
a57a6e9e04f899ab6c6936ab85db778b3c4c4507

SHA256
efcf8a350b98eddf6759da56b759de7139491c072acbdb8fc72142ca61b0e2dc

SHA512
0b303873abf2f5daa86a8970155e19d0b9ca360dc2991ad0561ee8d9678b975585c3fc7126419e78866d4497f84d26097d4e742f3fe25964af09ed76ad461fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
deb54e28554ba8f4df6d5584ed5aad0a

SHA1
0a34018dfc151ceecc8c0e81bcc9659f7b8cf92a

SHA256
97e71fae83d210de6f80a9554ccfe607bc77cc88074797eb96ae07ca876b1aff

SHA512
4bcb2ed592d9762bc3821e56362297564161a90768cabb9738fe052f1690346bd827d707e28d5d177b82c164bc0a1c5d5e43ed4d89d3e76b93c6087029414ed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b6da1bc1c4b1f256046979f60c350e90

SHA1
a5446c9a03f11f81ae032cb48684460eab11d0ea

SHA256
038cb98f82a92b9ceb044b0f6b63b9b884594b600c4a4b81b49656cd94f33913

SHA512
aa0c3b106a4654dc7ae37f407d1673ad24781e3866552ebbef7c2098b09cb6de2320996e5aa87dbe2b32a544813fdbbd82f443f45fdfbd7c4c27a2c8188b3a08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c06bdf062b738caaeba9bcff0bdd87af

SHA1
a5def93358f789f3e9b83718fe743640354cc21c

SHA256
e5f5a6994d18ec1da29cccf4bcad6ff9e1f567698402e10b173f048a810f77c3

SHA512
660b6e9050b1bdee471f15dcb1bc72ed48eee017acf01ad80ae98f21d1e8d8a2c338ae89799c6409887f8cb16d60ac00f931a20dc5c251df895ffaaf550e5052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58cbb7.TMP

Filesize
203B

MD5
d61fdd53f576a1f5387c6d35f1ea73b8

SHA1
925c5a64d10ab1f776701f910419a1123f9b5410

SHA256
d53feeb82dd85df239760a7f112862748c60a370ad869e5ef627f2e94feb74bf

SHA512
99d4f70b87f4a60cf2fe5e1ae6916b40f65cd451366d361e4fc5ffc1d44f77993eb82fd36342754161806fa1235d0f2c62ae569b943c57a6b2cb6448d433e512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
65df1f57d4cfaa305763423db2cf78e2

SHA1
fe6eec491776eab1be49a9f1bbb6f0ea9084b6f4

SHA256
ea11f8e9eb70fe474cf64da96cfd275e2ce3a1f0d418cbfc457904cbe8a63394

SHA512
8d459771bcd07c26b2f7bb3ba378f49d463d8c1399a941021d90e3d7c6edb2e989019afc9d0aa8cd6659c25d91ef6166977da76c34357a4d4b0ae1399a67f4dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Filesize
3.8MB

MD5
e95eee241a4124fb9b5d145f422e0bb0

SHA1
7d0f13179c3d32d4e8bef4711e0ee53872c07913

SHA256
7138fccc1d7c9ecacaa477aa57d3bdf03b2a1e16a6cd1f6133ab59033d8910eb

SHA512
c5225090546e20b14ecde83fc25b7c770dd9c1930bd0036cc9027428f17a937794a88476e55ae23607ca6d7c5853938f6e3c23a1723e22ea8af3521bc475d483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
4KB

MD5
7ddb143363fb79498717a8f3546a9d16

SHA1
3314c34e28dc853d4b88a0afd0a0c4cac428a960

SHA256
cac1be9739e0755d405b24c9bee66e13d5515c8b1fc74304057a042ff79f42da

SHA512
4f640130093eb58e2effbeb7cbd0222a860e2ab2ecd2209a80fafd4075f29df2f3174573947888d4f8ab8eee2bb04f40b35081738e05a9564dcd90ca801c9524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
a4bc0d8d7220b9fee7d1feeb81d2e2e0

SHA1
15cdc0c3bf031c4fb16038a37996536ae7ed25b9

SHA256
28acbb701a4c350bc39f41e22f3607592d24fc92d7d685ae495a99bddd1b3d05

SHA512
4c0702e4c78c2b80d626fd0c38b0ca3e98f2ece69986ff2f4c377e12866cb41d0214655923a574d5d5d4754d983394e2bda7fd121f16e47de02a025710bf2d2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
318B

MD5
d5340f27fd619d269b4b3923908a9f31

SHA1
7c3a36bc152889464469e0e7745386dd011af34e

SHA256
fd2bb5374a8436e36ab338a2864b6436b2a640bbbf1ef00f18fbe4513273f080

SHA512
6d863256d415c000a180a15d558f135ab687772c5a8ed62e41cae52c3dd7e4534f4560f836d62983b3ece69e8d327012eeb4a23f684c32c3a7a18f784d20297c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
e69acfdbde17da2a41e3a407a3e838d3

SHA1
8582db14fcb46fa10c78524372c4f501c9676050

SHA256
41c5bf10d6f470af5dcdcf0169e81e7f8e971762590f61e8c7d9311c08acad06

SHA512
8f3f8e3848897d1a4a24e8b79e7f35a526c951eb7afde234ab8eb387cfb3a080860fd2f967f3fb1d651e5c53162b77c3898beff29c95c83d142c0d64809d3ed6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8f97714a5dcc0738b8af0d04bf011dc9

SHA1
d4832e890230f3a2c7361ca6852deae5f1f74c90

SHA256
565f34e99adefc8862487fc7bb48a1ce83c119cf09cd94e8140f89f5fbb1842e

SHA512
6df8082ec88d10eaf5af4989808d5c427389d03228606d6fc2ded92c1501449caf577024bb66ea064453fb9332ed855f69869c4539a5f44d66313e9f523ddf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c5aacef3ee2373c50dfd45f1f32fe2df

SHA1
4ea4bc77320ad42ffd5860da96c83242e1e860bc

SHA256
beaf0bd56f3b81c3cbeff6435b3f02310a6c0e76f0168c012ec6c91fa7179721

SHA512
26eaaa8a5a7589a96d69da044f11b0fab8996e9d54565957f76033f97d4cfc949926f483547de35c64e0a1237325021a2f3661eddeee1d01123072abfe1e2c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1a8d9937988efa4d723b180100957c53

SHA1
7c2b013c1d1eb9f0bf9f0d94fe559ecec8175175

SHA256
2aac0fe2f079ecdb1c30a5d12cad9a02fc2f0b057cf042bb6c69d0f7ad32d2aa

SHA512
e1da61b01cea64b6ffa26d95f2da79815b844087e1d58388e0097b7589e77989c2d4bfff01e1b9886b082f41954aea795fbc297efb88847e67250c3a4b058ec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
32ace1801855379d8f60649b0843edbd

SHA1
29d171a0792817c82ab44761aea974e445f79592

SHA256
82e5b25bd0c24755a3bb1b136ae89557520172db1671c2545167e5f5c6a43727

SHA512
7971776d3c3095285d905b7c6ecb69288b9c7f10888ef60d9884897acf4a3e8d027bf2cf57f8636df2f246d6371181ede4927edf8e6b30175bfeb3a6560e677f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
12KB

MD5
1848bcd5d59aa4c397738db7eb46c877

SHA1
36be268128e0ab61bc83319763c3ee5c518e3a98

SHA256
80fe6c448816431210267ce4bb22aac27beace4ac6f12f64677c610bf4c0bfa3

SHA512
13879623618b0a4ed42ff9af82882a61ace32fc18ac6ecfe09ac3d6348e098f2a0f0e35f5a90dd43754bb0ccde770605e94f8302ff4f6ff249371867d3e5ddc2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
14KB

MD5
0b7684c8ec1d1ada65ea21a1fab4a0f1

SHA1
bd3112bc0b82c23a258f4529f44804c3894c2332

SHA256
ab5454daedd20a39345815629ed92cf2a490e7459528ba7e3415b019d90a6108

SHA512
0d6946336a67a144b8509b76d163c03f83f14325cc8b82181086d716cc18dd6f1152d2ecc8cad5d159beaa7ec612334b338d3752e65b5933cb5593283926f8b4

Download Submit
C:\Users\Admin\Desktop\nexus\Results\21-08-2024-02-22\2fa.txt

Filesize
4KB

MD5
b80b3973dc9a9090aa10b6ad0b91aa11

SHA1
875933baf9e79806d6af05ea920a398b4b6d3cb0

SHA256
6f150dcde7590e6a6da0928933646bbc75b20ed8f938903afd9b1c8ecc0d306f

SHA512
7f864a3ef3db3c3df5693efb62fb78719cecd492b9173d28c4fdc669d67bbdcecaae74b583475268457be0f615ca034f016d3229957cd530555cd03a2d8fc17f

Download Submit
C:\Users\Admin\Downloads\nexus.zip:Zone.Identifier

Filesize
52B

MD5
dfcb8dc1e74a5f6f8845bcdf1e3dee6c

SHA1
ba515dc430c8634db4900a72e99d76135145d154

SHA256
161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67

SHA512
c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d

Download Submit
memory/2848-1183-0x0000000000890000-0x00000000008A6000-memory.dmp

Filesize
88KB

Download
memory/2848-1184-0x0000000002D90000-0x0000000002DB6000-memory.dmp

Filesize
152KB

Download
memory/2848-1185-0x0000000002DC0000-0x0000000002DDC000-memory.dmp

Filesize
112KB

Download
memory/2848-1186-0x00000000053C0000-0x0000000005452000-memory.dmp

Filesize
584KB

Download
memory/2848-1187-0x0000000005560000-0x00000000055D6000-memory.dmp

Filesize
472KB

Download
memory/2848-1188-0x0000000005380000-0x000000000539E000-memory.dmp

Filesize
120KB

Download