hxxps://mega[.]nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM

max time kernel
208s
max time network
221s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
14-09-2024 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
226	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1287768749-810021449-2672985988-1000\{BD47EE32-58AF-4F57-8ACF-2DE2463DB87F}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\nexus.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
3516	msedge.exe
3516	msedge.exe
72	msedge.exe
72	msedge.exe
2580	identity_helper.exe
2580	identity_helper.exe
3640	msedge.exe
3640	msedge.exe
3632	msedge.exe
3632	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 52 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2220	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2220	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 4908	3516	msedge.exe	80
PID 3516 wrote to memory of 4908	3516	msedge.exe	80
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 1212	3516	msedge.exe	82
PID 3516 wrote to memory of 4684	3516	msedge.exe	83
PID 3516 wrote to memory of 4684	3516	msedge.exe	83
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84
PID 3516 wrote to memory of 3256	3516	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb00213cb8,0x7ffb00213cc8,0x7ffb00213cd8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2832 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7536 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8712 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8220 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8316 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2488 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8180 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8848 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9544 /prefetch:1
  2⤵
  PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9720 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7828 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,2374361937397574905,16303203251195317258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7864 /prefetch:1
  2⤵
  PID:5584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2024

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e969d4a2b40aef8eb0736379c0bcfb

SHA1
608c4fdf0e6b820eed23b793884e11210b32be58

SHA256
82e6cd647225c2781d32207ca56e1bf5e85dddabdfdf67a469c6e8910062975c

SHA512
e38f13e75d7a74400b1c21be8c5d8045c366078c4bfd7a25de86a872a22db8b383484c4f044d433f557ba3f181670398eeb7322fb6946a3bfff03875576b596d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc36221d3cc9a4657faeb51e3ea7023a

SHA1
22e3f8e68b2dd3992d544f8ca57c48c6878f77f9

SHA256
f393d5cc1a1b59d1bf0f19ade21515652b60bdea4b2d11780b904eb90fdd7b4b

SHA512
1d831b911b8e6970f3c829d7aed3c7d0faeb3f986fa029c8db8e2b2ced40898ad96b26311e620300ecd6d5a71f444582052b9ae11c4231224010096105bdb117

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
399KB

MD5
29b46ef2228d7d0ff5538a6042f88903

SHA1
85fcbb20e56c8c2ebcaf9d5ee3a442e449194601

SHA256
ed4d09c067524631ba4f93c8318fada5e09c4c099d49a88781733821edfe8e48

SHA512
2b20d919b16ba74a8415a64be12fbfeb79a8da66967b853c26ef9e6ca0fa103544273366d86e0587e9687796cd49352139bb29ea673f1d8afe973876d232b387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
366KB

MD5
4cf288143df40f59ad1683ce7ae44987

SHA1
60d4685f747c099c99fabc4c1f8c39032f984ca1

SHA256
658212b91e070be8ab9ebd0c92b1d26736a94701312baef5a66743542e2307fc

SHA512
ec8a55341bb32f80e7f2db5302f6c26a5abb4e7eb553a77938a24cfab01f1b926b0c8f26ae16bcf13b8e81e040dae63bd6813f32c0cb780167173bc41f86808e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
497KB

MD5
6a13884b18cabbf78b0dc2fdb195e9f5

SHA1
abca68e077dc582a30f50a9edd7a42d01bce2bb6

SHA256
d4751f46fd7156b0eed6b9e753db3df136f621e7ab2fd8dceade57242c814d33

SHA512
15b2509942a88b87f8728b76a6724424e013029849399ddc04dd19278c0064b0d961e7a33d106b2ac0423b893a37d393663d0e756b6ef11dfe26ae12a9d51f40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
508KB

MD5
8963553d0141ada8105649a9cf91e674

SHA1
e3f82a2ef17ea92a2632b3a63147ca06ee434e75

SHA256
1437b41393ef2feb26a30ee4f7976119f86f18e6d53972e47895b7e9b6730410

SHA512
acd90d2bb232e90e05136d7cb960112df65b2a8767081b54e17170893301dfc4abc1ec223e6dd40a71d93c5d5b2fddd55bd91a82a1a32de7413be728115ade73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
473KB

MD5
b7b0a5c8a253b87559ed9295e45960b8

SHA1
7c4e02218ed280438be6f339765a8d74d37669c4

SHA256
6450a54915a1302d551267a155725ccca1f1e5f1072cf3313071cdcc366b5d55

SHA512
84a401572b2c9fa78b99e8aebfb55331b99ff38919a0a88342f799f57c073722b249e8015d5c7c4fe7634a1d9e19fce85fdad4cea94c49c2c35f9c2b3597724e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
467KB

MD5
1fc01f0f260606e86c2ea76517feecf5

SHA1
b90564929342dd726f5d6964d917e7953d643b78

SHA256
1e8d55392e39879ae4e19bb42ed78be4b866cb976bf9818abb75572e4bf9575b

SHA512
cf722f927c001a2bc7e184e23d3c811fad3d8503338d37d402da8c8c59f564bb8b0738bb579e34b93e354c55d544846de961999c8127eff4d717a9beb1bb34b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
508KB

MD5
e18fafb482573544d8b6c4e2a3a88e0d

SHA1
d4426603fbc0126b3e9e75101f3e66615e4f4cd5

SHA256
ec1c655986c834103452c3cf52fc5a8cea967ab8b9170dfae9d1e42959ed1394

SHA512
616fada868bca8b0885bf03610306aa7e8d48f31e2392aee1c0ff0f30707851f17889b4e7cd0a8344e4d871067dee83cbe705b1e6cb9bb3759bbd1d2e0476607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
469KB

MD5
184008aa58532dc330bbb67885cba62d

SHA1
7abb1b81031fb7b6727778860ab073905bcabdee

SHA256
07d7f1cae5f34137fc1b4cca77ca88bebb96f2ee241b4d8de4a1cb1c347628bd

SHA512
c58523981f0b67ec0e3838b2b68de7fcd02c42a2e50f6c90c3fd48a3aad955fad78dfa0d844564ce8c3164c43220008c03fb32ba9e09a60306ab351dec1f67ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
744KB

MD5
c25394ff13b9914ca7175a17fd3edaa1

SHA1
689c57fa30ebd5e915b5c9477a27279866cb99ff

SHA256
81f7408a142f327272609463c5fe63b505fb00db689e31cfcc48e5c254831942

SHA512
12ffebe14e8f6d33bf00d4548819c51472480e6778a1264ae36d846ddbbe855350416df6f41d73ed06ee66523b4f11c830b624e39136704038c83193fa810b68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
302KB

MD5
d0179bd249c07b0cf46de38d32deddb2

SHA1
dc5f7e83360b6386be92c0bc5eda129fac899f8f

SHA256
ef8755958dc3ed928da3382a69c36cf6ec2bfb1a98f1d9e71165ab81fe735e6a

SHA512
c411e395acdd612519623638377840a7908c6cd5895c8c77446266f6e7114f2275d3da1f16197cd16dd98fd8ac58b06361ab3d50cd17e433cc38dc56864defbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
436KB

MD5
a649e3d93d242cfd1884f93b7baf18d9

SHA1
4739ba9d25d7b894cf9ebcdec72a1f25a6728c7c

SHA256
bed7898049a8fcc7f611383d60758510c4bb38bbcf218d3011c7fb2426a67461

SHA512
b2d9d4c935e9dc83d7dffbd38369f5f84e277b3cef9dc10b77256e0990760cada35be5d20afba0f27366f9cfc7c4239c237760c13985bc6298deee0faa399e34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
500KB

MD5
8da71420c5c9639e04dbb79e7dcfea1a

SHA1
aef32b04b7fadc30f54e94f388a39701af1b6ac2

SHA256
04ab5afde4357c1aaa61284f7349461ff843276ab4d9159e2c622758fc783fcb

SHA512
444d5e5e33cb69f521889e4c0a3bfc291c9e3a5b3e349d49ecfdaed9db7118ce5b5c245eb145c016753a899b0b397debd12e52509b1a8a5c862fc3dbdfe08199

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
244KB

MD5
e879c3ae7aafa8ba89bcd3603214d6cb

SHA1
0805a9cc74841bb8a8e068688a46139549e0979b

SHA256
fa9e1dd82c98301f7df56c2fa47f9ebf5155ecdd758a4566f653e2289e517ac5

SHA512
0a33c8c06d1901ba0e819c3d8f064645de4bedab3ed57a18eb7fbaf45eb843c9e1a07ef0df6c436b4040beefc81687220bfab0628f515feb12de7dd68d0408d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
489KB

MD5
b7dcbff2ba9e18098af3898797566f4f

SHA1
c44a8961721a9743d974c1168377f649f249eec6

SHA256
5e906d738618166f0b8c675399da6209f4aa8e39ffeb5e6028fe632bcf14a2f1

SHA512
6b8723c1a145500e14661ed53c69313b704f385dff8471bc8dce42fa394ba234faa579cd32c0a9668de597a7a342db0d8a4519bd6b042710c82d291a1951f428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
446KB

MD5
08ecacc180498406e3bc21de2f570127

SHA1
4cb64139aaee13a08834e880b5c64b8b33e89769

SHA256
5196455d37799a20710fb695c43f9383288bdf5a689ae84b222565a66f384802

SHA512
0e4e106341077c391c741ad99b10c96d56bdb498580414f4e6df8b4a27f77f8b5be95012e28e58c6f275a61a17dec0e1be378e20619544baa2987c75acddecdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
712KB

MD5
29ed3d2ad80c070bb8d732b41599b506

SHA1
e861ce37801dd41eacea23176cc0cf85791be413

SHA256
76baa70cab8f72e9ac1492f620725195a4f022d820d1db592c4992d62eaeade2

SHA512
1ba7a9bed82ca98e22ec8ba4152725b733e02a729ade927000d3eecebbbd429159151c52dacda4e971020b057b329bf08e688c4c929db37a781e5041ccf2d54c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
496KB

MD5
070e4a70b0608b6eb0efd08951d339dd

SHA1
bd98cc13f263a5f03f03feda170ca5df4180767e

SHA256
c2de9651fe3a092706e1d9fc4e513eaa9547eb5c3ecb7126a7b7812d46384661

SHA512
cc6b545f20a24b71fcaf806aafa813228f1928394f17495f4ba9c58afd0933ac3345048c1759bbbe12abc050188f0a0ebbdc41f8d35164884645f63de2057f99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
501KB

MD5
3dd44c963fc42abfbd1c1f90e2218778

SHA1
8f400ca60cf9220c4442ebbc4908c171c128d5ae

SHA256
d47e9fa83de45ec46a76313173c12fd9de29289fe47f90de646a35f9e15c049d

SHA512
eb0ae05f5b281f1352ddcf8ea613023f78cc825ce0e2a523725f85977939daa5932c52716ba7a8fad90aa076f04a3b14baa4ae5fa89cf0ebc2941ce88a279041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
474KB

MD5
42d5b1a20b3dad1d4c61540c2f37a514

SHA1
a5bc31e8926425e02c90c746619657b039a582c2

SHA256
6d5e4e88b66a2e3eb602bfafcfb16dffb512733daba0da7510e08e516c4b648c

SHA512
122df31a9436ebbec9c5b634c6a99a6d3038ea56f4a833470b953bca3776feb38828171e353d9e04c2861cf3ce178c243dedd30f3129a99c274ff7a75c09028e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
297KB

MD5
dcc48333913009fa4202a5f14fe2a626

SHA1
afedc12791979e23889df2a6964f51645bdab46e

SHA256
b84ca82038b6ec60a770099c31637fcadc63a2cf7bc10e2de49db3ba0995ff31

SHA512
4263112ac592590f6b6b20330a4a28607187b56043eef14b41a26528a76f60834eb91f0db83ca668583cd203f8fe6e42ab561185f9cfd620591be01b434b2a05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
391KB

MD5
c5ba6d6664cf5b86ce2bfb81c7a89d7c

SHA1
b29556ae5934cc3ae45a2eccf8179ca354e32542

SHA256
f3399c822817498b12ebba41ea49e76e7f6d23dabfb5ae97e55c183d7f7e2ee3

SHA512
a76e8d69cb2b1bf8021aef63af0370d71734c617ef0856ee61733bb8bc44c654b45dad9a4d7d94a43982db889a1f41a6837c4638874b3b675839939957becde8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
452KB

MD5
81e17fd1825ca42e110f251d4487d670

SHA1
5abe5eb2d1bb7b3b6e6e78523046d212f1cee4d6

SHA256
e87b6936b3e0df4cc2e63d7904e9d9491c5f434ed4ad2ded3479aead0ce667c9

SHA512
ea9393877a147617cf801cf382b02686c3990bb59ec014d897d34fdabe6f04522e32b936d103435727c69b7f221a98bdd1e34afc06ff119fa0b0a50d2ff225cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
40KB

MD5
71d77607b323bc20be32a02fce4cadfd

SHA1
2a18236090f47a4e1f0ebd2b9f1e4b0bc0053573

SHA256
58c04ac027b15931acfb17be4a134e35c8bdd3b99109e617895713a42f32d84a

SHA512
01e141b3c6ca46a83626f19e35a8e8ed613e2dc90fb42977752632c9818ea93f9b8f06e1a47417fe5cb8ed8a3bba3fbf62bf28da3f15c6200a6b8ccec72c4005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
432KB

MD5
057852173e958810f1de0e8adbc9d462

SHA1
bd05e51244966615a9dc2b0119f7e8cfa64f22b5

SHA256
9c90f27443fbdb85519985333a8b00c3cff0e10a2753955f41890342d64362f7

SHA512
230ec42dfcea740b4fb37e3c7559da2289b7bf2025c465bf055db75659c7f9f05ede374792b046ffb3365f8fa5dc34e23f1312984c195c32a6d42147959efc86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
88KB

MD5
94676e314a869cea8b70fc6698cb2c48

SHA1
c681f9ea637011a45fa30e4750098dee378880d5

SHA256
92090a2fc2ee13f67411a5e5778e3265e7401163c87beffa8e0392ccc765a8e8

SHA512
59bbfe9127e937271e5ac8443681dd48c7bfa882bdbfe3e340ea145ee8b6852d9a612d67f51252985fb0e11b37cafb42eb3a7e33b39c3af9aecdce3c5bd98e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
182KB

MD5
48e1d8ffd72fccbb9860c76f80ed4d3a

SHA1
d5177c9eaaf6bfd84f4417d9b30ddbf8f29ecb69

SHA256
351154e6bf387c7b7b31a0baafc1ac257295d2bed6b0458f037a0e2d90a0476d

SHA512
6ab469aeabc6b2c7475dc0d7def132c5c20ced763ee554d7ce65f5a19d25f3c6b1e62ddb0c4a710f970b5154cd4c260fd3e597eed48ced5e5ac65a7dba766981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
67KB

MD5
0ebd202adc68f0c47d6e360fbd7139d8

SHA1
1eb3c50332634e57b9aae78fb64678d9df1ec526

SHA256
d3a3b34e474e154344a6647a09de14f173f169d52a277d66fa2155c02ebe973c

SHA512
3c30fed347c61615dac75e0deea85b2fc9da95a1a38967dfc8fdb9438c3f3aff6bc8551f4ffb4a60850189d257125336e2ed36383f718c4fceca275c6991bd6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
178KB

MD5
bd03a2cc277bbbc338d464e679fe9942

SHA1
cbff48bce12e71565156bb331b0c9979746a5680

SHA256
983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f

SHA512
a8fbc47aca9c6875fc54983439687323d8e8db4ca8f244ed3c77ca91893a23d3cfbd62857b1e6591f2bc570c47342eed1f4a6010e349ef1ac100045ef89cbfd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
179KB

MD5
8b4f872c5de19974857328d06d3fe48f

SHA1
32092efbd7938af900e99d63cf25db246c6bff26

SHA256
30f77a5ff0bcba46d4e760b0c939a5ff112da0d3ddd13a261834134e00cc21c7

SHA512
c7b87b142cef8e1b31e5561593db2ac5eca2c578a724204464e9ede977c8107f3d6748e9b52d072aff04eef07b232b8f19286aa2267bc325c57926db1a2a3e9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
64KB

MD5
c86e1b32988ffbc37474c5ea5457a62e

SHA1
3b337c4d43ff0b4ff79f9bbcecff8143839c6cfe

SHA256
d94398ba2ed0b438809ec4203c64c002b4a0d960fbd34ab144b78fe7a49323fd

SHA512
58ac67c26bca36a29799d49ed95980a15b1e279282e425ce13620cbe93a8cff74e1c520b896f8e9545a6b7eb8266394547949d88ad96bcf2a879da65521e7f16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
30KB

MD5
6fb26b39d8dcf2f09ef8aebb8a5ffe23

SHA1
578cac24c947a6d24bc05a6aa305756dd70e9ac3

SHA256
774379647c0a6db04a0c2662be757a730c20f13b4c03fe0b12d43c0f09e7a059

SHA512
c40f4771c10add1b20efb81ee3b61fc5ede4701587f29a1c2cdde8b6faabd1c76d769bf8b99aa19082012f95d99ba448a472463fb9056acd2e43542e14e605cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052

Filesize
140KB

MD5
b8b8a1fe96055841a5cea0cab351ed5f

SHA1
3ca899e3bf1aa6862775ab2aa0c758dc4e6f381b

SHA256
04cd38275bfd0d5fa679e5312eed2c7ba1fa2f0d6755078c76196db7db4e8e95

SHA512
ac3066c2a60fafc8c732f4ee53917f1e00ca5b23157a62533d1f191d3dc5a686f5cec14377844ec8308cb3ed7e60fa261a3aa56b5820b01fbe36ea8385dff094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000058

Filesize
180KB

MD5
cccb897485813c7c256901dbca54ecf2

SHA1
a53ca00171f545b9d9d1ccefc210b6fe0fde1064

SHA256
ae88fc0d7a961832f809527d30bd3983a6866d42f66a56ade23f543681594db6

SHA512
19e7fae2a53cb2ba44a8a1a8b7ee600db1eeed78042ac7b1f9eda47bb4ee20efcd56671006729f68d81023e0dd7a9f3afc8090df1bd91ef14788d4639ceb0cb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\022c27b968c04880_0

Filesize
3KB

MD5
f22ab733107bb97f75f048584905e40c

SHA1
ab9f203a31acb47841d9989ef43d1c2e03d7dbff

SHA256
59bb6c34e63d2d9bfc1e91836c673d36850f15dd0a6fa3f442c8802729d8170f

SHA512
70088ed119efce4b2f890b17a748e2c3d15e08d56e8cafa61e7296df9510efcac5c76523d71b7f1f44c5ae08b547bc457ff659c1c29b688d13e85d2380db48a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e34d0fa23f6618b1_0

Filesize
32KB

MD5
bad05370e5fda9b262c313e48e20462b

SHA1
a069a7d67253bd8242844b999f4c84eecfc84ee9

SHA256
86d8026add919be06f5839577d94f45e4082636fd3c2e60d0199d8d4f0b451a3

SHA512
5dfaf4c864dd5e4b20eb1db4f2c65f65702336a8089017fab2575a00c11df23ff9d70a402eb83fd3ceb727a5e3158462009c18f01e02d71746b81cabf7202f88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
fe536e221d8661c640c16d5580be06cc

SHA1
720434400c4536d0d491ad44e4475da0e29065ca

SHA256
836e725d5e47efe5a01ad8f4fb96bbe5c52ef0ef700dcb8bc975f8fd2ab47f61

SHA512
5c47fe2ce9a7edbda5a24842f5d5c75ebcd63d6b9929e5cefc037fa27a7b04ef9588cb43a821d6fe750804df6357f939d232751eef9c465a773f36cd4b21d24d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
653f550d3406f01900cb385221a0fa16

SHA1
ed149ec0978b1a81a0e524c1d626324ac9eb369e

SHA256
4bce77a4b4d6cb2169f37e85dcd62100f92aeb2c08087b833eeed72879ef8702

SHA512
2c71233ae63040ba80c07797d5923173a0a0ba8491ae0530e543527b595f1685b5874c990a5154d3d25da98a10c7c8b47c326fccc2f70cdc0340ebbf54bcd654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
729B

MD5
75fa9132370173a4f9d285ecaa6b86f2

SHA1
14a13d6009ed8c0c08257c8375f2ae613b02aa51

SHA256
6a05c9afe7466802bbda4ac8278ab0bd6f64bcde3d7f41a0fdf1510248a4b46f

SHA512
559bf5b764fde9f0006c5ddb5ca0d30b95b0d435ae3c74de85ca4adc54f7ac96b89271d095db4a85cd00938451bfb17a9d2b7d0d5df40e9cb9ec4681ed8ec77e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
731B

MD5
ac6b786e54a844ea4572e4fd5d79428f

SHA1
5a9064f8558dc33e2ddc3ec11b3357cf15dea7c6

SHA256
2cbb842b721cf95855e3d0e25f516c3f779984c1ad5bd33d6d89a4d42b518105

SHA512
a88708a2d3be810d027ae1243dccde77220870f937bbb4030e6b76fdaec9cf7e179d4f40be47350db877739c7be4a082e4784a55be5237f253f59fdc51106e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old~RFe59b5c9.TMP

Filesize
598B

MD5
28e5c4ba4cb6a3a9c717338401b2afdb

SHA1
17a40ea10f94c192565b59f9112d28cd78388323

SHA256
57d24694417336ebc84e81b2244a9ec0416700d37ab19ee0ee46c9952604aa36

SHA512
f851b31d1bd565f0857ac8a8b8b2577a4bc45608b527f3124edcc6b1c5bd624dbe22a3fb62d12d16d94709cab0b98a3b8dc08debeac3a6033ffb81b95f2d126a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
73919f20c69127f6ce6a30997f448cf2

SHA1
c4a71278f2ca6779ce745735d1c6fb384e67494a

SHA256
7463f5b50dfce4d6c56d3552c1086e200f686ef3c66edaf86ffc0b41c416e12f

SHA512
4cbe4553581f2f2ee6d550b02ec23d82a5135d9e90446d5235204300a4e3d0cf72b3c92c511e234ef35a5d2b68348a8ca2cc8b05aef68d9eb4ed1acc4ed3d435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
0cfe2b0f946b7238ff37f5f30b8dce68

SHA1
b52848f7b45c88ef08e5a7bc5d03c8557d4a837a

SHA256
6eb78cef694c1f15d80373e8933428f04c1d8c6d59c3f54d5e93984760eccb21

SHA512
4763c023b85032dc60000ebbb6b32e7e16107ae15f2d4048aaaa3382b3e1c52ad013e6de98dbf17a7ea89463bd3b079ea0b38d80fdd1a464f6dc13804b094688

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
24b1110573e731ff699c55af7b6cdfbd

SHA1
c675c8c6348d6cbfc70b2132e5119231af9a34b5

SHA256
3f9211b7c49187471cb4e76aa15d34ce557563e420d586b33c021e96884ce0d1

SHA512
a569b438c200e5e69ee51eca68b7624079d76faf5da0a8264f74d1bef5ceda657b0e6adaf2a19d86d0121f919628f5085ae2afe50aff3c5823c9b8026d9c072d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
99480d4aa596db6cdbf36befaa7b6566

SHA1
04d358b856e1570e19705ed1b30d849c0139fdff

SHA256
586f51f805322fa4d8383813b499b6ab258d576b74e79dfb20e29277acd2b229

SHA512
c394a978e6086599e9556a4b0d1391f5dcd2f409fbccfa6af6706c6b2ab8559e465030b51c89b577e6f0b376dc6f387f21f42168ba2734a0797ced2f0f8b91c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
722ff5245e88b6693ad89d611055d1bb

SHA1
1ffb17f6d0a6396e4fabcbc20f6697bc447d79a1

SHA256
bfe78dc5302bc98098e56edcab7e16c9513785b2aadda19eaacad9adc393b58f

SHA512
e81e7b9c366b8d9f64908ba48bf70248767c2984ac7ffa21534c11272d663399ae8d0b825ddb7f325a9defa318e6f58c626d138b9eb8d236f14e3bca6fefef53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6372edc7f81cef83241437af749e330d

SHA1
a2d5ec6b177f61ffcc285f8069b14e5d92c218a2

SHA256
269a20231b16f3a6fc9d27d48ac974c26668ccd028819d8f6afffa7fd674547e

SHA512
4e7024c5df74d9eaae436baf763c82a65161fcb3719b2f0095226776edfe4b2594087c61e48922e2cc81e8bdb00ba5b1056d2e4fecfad1e34da8f07af6a6857c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
48a86e48c203955701e42f319d2daf5c

SHA1
904f565b5bfc14aed6d8b8b4db07358983573580

SHA256
30ba52ab97e3ae55e68f90f15f1fe70effda3f9d35a27c9a4aa8d4a7e0bffdb6

SHA512
52832b2bbc65320ab80d4c0c86e50d804e6c8e5eefa539cd50450db6f1604a6666c86eb4ba2a6c55eb6dfe7dea6a2561f7fb2240055aa8fc532ecbdf528e4799

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
510dbecdc10eb6f6d72e7a07b7f25304

SHA1
f8d6a845f07ee4d707f4fdc9382a3057e49ea9b0

SHA256
a299b76bbc3f15a45beeee6e2c877c0cc58b9ed98fcfa69389db89f1355c2ca1

SHA512
f7e4a7ce396d66185dfac9ae83a13aa6b51496797e9006774b1d22ac722bcb4716cd11b3ebc694b844259ca594257f0a74276636bd199c0296bfa2b0bbecf550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
753ee0da2dc67d6d20cccd1acb9d90bf

SHA1
21a97ead361765b45f2816b338145fcd300e4364

SHA256
31fdc73e6201717b27f6416967203dccd7bd12d17d70778c3686540abc823042

SHA512
d0cfe39ce11dafaf59032270164cc0db097cf1513ec77b8285e14ccab61fe7d9014e112fd90280d89ad6abfd956aafb4986bb744e6cc969f2200db31da611099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
9f91f960cf7a1048ba0a93960a7b293c

SHA1
d9efee875313a378a84dbf7724213a5984ee84b8

SHA256
5eba00a394b404d00963fc66a6960cdc95c9ebf281f8ae7ae107d83d5fc93531

SHA512
3cfd826d2192d240edb15a32e7b58ddf7618c646e8b953614fa41bbb47d2256f4032c940bd484742782efbf9a520ac08e0bacae38eca1e58a12ac08434749453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b95c7d52b7020dcffb71d45b61fbaed9

SHA1
4b4eca66dbe50aeee2f29b94ba602afea65da12f

SHA256
b9d8d70c9de9c8abb05e56fa264566bce81cfbc8bbb912a80fd46e23f6dd8779

SHA512
a2cad50fbd9424cff27b01a89524bd9a5d1aff2e0605b4fdf5c78b82a9b14fb5ef46cebb90e432b2dd3c845486128fd58df4ab2d2358265f57e91e3a12704576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
8c0d6616af07f61a695d23555f03afb5

SHA1
4d920d7f35be99217c86ea4dc2396a55e960a537

SHA256
ecc17c289b6a0f4fe10cae7e9eed2413279d3d4354d82fcc9bc672b7bd7493aa

SHA512
f903fe7977d14cc2d021bbf54f103421d0500cbf7b7f3cfd4ba93ae56af294307ec1b7d82c93d1fb530bb132ef4d009aa244ce2a60c23d7748b5ca08e4c7a2d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
67c7f74fe3dab7fc3491fea6a3d950d9

SHA1
c966bdf9961416807572fc41ddf4fc9e7f104df8

SHA256
002a9d8f304cc196b803b3c0449c15d65f4419d22dcb31a33276e9c90d732fea

SHA512
a3ce8f03c92bec2a6b21ae75660ae1181302751e51ddb890c62ede26eae9c97e80cfa0991bc7a86a8557151f72621417fa4d17d89ee532d9b14f0c6825732fc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57ef03.TMP

Filesize
48B

MD5
eec53a005a88f267ae7e55fa44148ba9

SHA1
8d08a74da9c990f7d01af6a76346aaaa9f352ead

SHA256
233b89b32298ab61759a34f7caff1842a3364523d7e2a6f24ad0687021bc3f1c

SHA512
2d0909d7cf1d41b38e6ee337076f2aad2b3a45d34b26097749bc0a514ff866c9321dda8597745c6abfd9f41bcde37d0f2ffd189e92ba3240bb825bf20d5e82ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
85a2e6e8ed5ef6e2fc2532167627db45

SHA1
697a97a23af247a35fc93edc79d287514e719b01

SHA256
6ac4c723db7c5f55deb6a51d9c1a5db8c558115476952f2ae88c963280366d37

SHA512
e5bda37c71895bd48e3eff9368ba9c5e3234ea5a2dd5e8902863768660e46756eeb97ed9509c85a7abea87560213fb5c94c250a6285f634d0ce11e32e95faf39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6abf17dcaadc0f7d9407a5406fe133e8

SHA1
72b4573c58eb15e007601c7106e9c1673d58463f

SHA256
f3e89d5bf7a8250dd25fe64fe03b9c206ab18d87cab47445fbef4bfc9c9c3053

SHA512
f226bf7c5022f85a791d54143aeb90296ebe7e69e232e9a5b16704aee12c92e69dfa8a1feda8450bf2f25a8e6f75632d38e7005dcdcc403353668a1ed63dcc51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
e317fe516ba04d7738eaed213dd88c58

SHA1
e60e585e9aa6f856e341c8007ff706a4d2f676f4

SHA256
ee6f1a74c3f2cb8d2480214378cf2882c152618b72574273d5ba29fd00a9d82f

SHA512
016fcdb310b1100274313275289c61551d96a4bf41c967839816739ac5a566ad12c0b3b17360dcfccf9277d73e88299a164a1f0a70f724036de2e74f32087679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4e913518236bb86081ba944d555fb3ef

SHA1
943b93f9b21d3b86ddbd14c8e3b6eb43feaf9c66

SHA256
c791c7ee6590a879ad1f124ba6f1e3264f62312a2d1c57fcd30e7dadc08a9f4f

SHA512
9e3b38e6d630c5274a0db59453273e53731a64f8628c409a4dae7c89a01b28c13b56b4c92274dd00e863073b9e627cb12659505902bc11d50e42514ce2c3fd9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e72a2a66689244e7d00f91bdcd2936e7

SHA1
6cf4000f4cb9f72f785025edf40a5159229475ee

SHA256
6370f742b27b9a6e27bd6df51462a1208e18b6d34b31a26ee5051029541de0c5

SHA512
8e5ae0ef2abc37e321b9b3bd72b1c014736639d5597d3f41c354db0ed9ceffd55c1c332337175cc23693d9658d31db9a658ac0b82b28e74de5259cb522d242fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c048b02523b6afd918b29769b3ab19d4

SHA1
dbdfe2fea0b5bee71f4fe623a0dc6d0775ff6722

SHA256
6a3709d2230802fab86a60bb86a2876f531ead21af6c95c34102a218281df49a

SHA512
375a6772971fa306670a1fdc8120488bd2aa81bcbc187667254fac5e2ca6920b381e3887ac2a6f0a9e763b1818c45f948b74024c5e12878864ada7031cdb95de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
344c136ed4f6ceccb712aee194a2807a

SHA1
77c7cdfa204f3426b47441c1f755c8acf4543297

SHA256
ac53b2c4c4b7ae6dc43eaf8ee3ebe23e638fa79d2896bc75b49d6c4dc110b28b

SHA512
4fd14f83b7ec5cfcf1039b5b3ce742ceb19527e2e1f3c93d69937faebaa6f7cc5399e97b71d2bc88dd830195a8d047d3172da594b1c0dd94781b510f9672c57d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6c47cc7a4573cc3b9fe31750c8a378b1

SHA1
b4d0720e26adb5f75f1f84eb9c49ad739ee7769d

SHA256
56d6be2ab226b67a577e2b26bd465ad407f689046f54bb836f13e05f50f90578

SHA512
f9b7e8e3cd7ec8732d93b27374fab8a55c1a4cc140ce794d1fcd0986d9cd8fa236b77eedb8a10ee619036d548a7551b3f230825f6cb56f446ac96fee05b41c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d8b9461799838287fa15060389b05d32

SHA1
d72cf988773dec5c50c2e762ba2ee46d2dfc770e

SHA256
e01dcaa5a124b7cc2c5fac249ab276efe33723de586882dac08c990fe245329a

SHA512
bb573ee21d2c5350787d122356b0f97113844c5467a265c4968d0b9712e6c14a1ebd7835a638022b4839a9ed4fb1d5cb1824eb481546faf414f2f3690cb17ee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
c0b147f3b2581527cbf7970bc6eb1b23

SHA1
9825820ea1a8a821507e94b85c14f1ac76cd04cc

SHA256
7d405820dda3c3e7004b927394099239d3587717d077244b9791a9fcc578c96d

SHA512
f4f44f3f08677c59d4d8d0e8b1c92ea4c4c2828ff91ffd88159358d7927c85318dc4ba0ae5e68ecf0b4d4afe69f77a8c9d6fa14d4de8d23d13d24bed29697a10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
174535ccf48ba583a861e4322245f907

SHA1
d493ce537ff09cdf52bda549be7724254f933727

SHA256
d001b7bb4e72573d958341064f971db91969ee31e12bd0cd9515a199e281c37b

SHA512
091adda4e8b09133b3133e54f8ff1a90533e856e8e60aca7d2384e8518d09226ea672049fba518aaa10e50d09a32958638c9ec0538811996114911e379c87400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f4df.TMP

Filesize
203B

MD5
6cb118e515eb8138142aeec33dfdefb4

SHA1
650292082a1e892fa65ffd0eb51ad79e03e66267

SHA256
c4a3564ef0a0c68e2df5d3aed282dc5e4f077f028229b403b8c0a566444669e0

SHA512
d7e1b2e59493377283871f48b51e73a8f00b21072e4adc798564e357965b2341101d4d5e51ff983efc208fa9bde4e8bfe71fe56afe0021878b787c2cc2e5bc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3357161033832289fe6c6993a65fa6bf

SHA1
2e43a85e4ad09e132964821ee2266ab9c6d231f6

SHA256
67201494da80e0c087a01642b6ec2da9d16e74dcb4354bad5915d93118ba05dc

SHA512
66c4aa9aa6c2eaf84d7258a24c4df854422f299022f3bb58137047eca89092b53636c889a549efffcc106ae832c1331bf6a08ed3c47377b6e5aeeee20931efd9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
bc44435b11c1a4e6dbcb7cbbbd332932

SHA1
1c1b3f4fab256a261a4a81ad792ccef696a00feb

SHA256
4686cca0b2fcc0b92056412564d0b9322356db35344cf98321c48db23dce810e

SHA512
bbcd7a772b23df42ecb4f638bbb4908a37cf22a431dc4f7323e5d05ea15f9b50b84d4f30b3f1f161b3148f0693afc1b3b092445d38a5754c97e50a69a906ded1

Download Submit
C:\Users\Admin\Downloads\nexus.zip

Filesize
369KB

MD5
a9bbfc89690d3095e180b07c6d1e367d

SHA1
e05cfdcb8701c3d9e3840aecdd77516572bc0278

SHA256
a66f58a10ae4cf981749ae70edfbe2759c93eb6eedeaa332c8dfafc3c89e8d53

SHA512
4d8358b3b4ed88db446d819d2e74fed91f51b68f9d9b2d8c63b1e0a1d223b6e044030eb4d5824c1fc8d4cd05ad05c1e684b05623485383d5866593989436d3a9

Download Submit
C:\Users\Admin\Downloads\nexus.zip:Zone.Identifier

Filesize
52B

MD5
dfcb8dc1e74a5f6f8845bcdf1e3dee6c

SHA1
ba515dc430c8634db4900a72e99d76135145d154

SHA256
161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67

SHA512
c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d

Download Submit