hxxps://mega[.]nz/folder/HZ43QRzK#TtqMnisZc9e9CG7Xc65qYA

Resubmissions

18/09/2024, 20:30

240918-zalezssarf9

18/09/2024, 20:08

18/09/2024, 20:08

18/09/2024, 19:45

18/09/2024, 19:40

18/09/2024, 19:39

18/09/2024, 19:39

18/09/2024, 19:14

Analysis

max time kernel
1191s
max time network
1178s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
18/09/2024, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mega.nz/folder/HZ43QRzK#TtqMnisZc9e9CG7Xc65qYA
Sample240918-yc2djszfpr

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
404	msedge.exe
404	msedge.exe
2020	msedge.exe
2020	msedge.exe
5088	msedge.exe
5088	msedge.exe
4412	identity_helper.exe
4412	identity_helper.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3364	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3364	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 3688	2020	msedge.exe	80
PID 2020 wrote to memory of 3688	2020	msedge.exe	80
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 5052	2020	msedge.exe	82
PID 2020 wrote to memory of 404	2020	msedge.exe	83
PID 2020 wrote to memory of 404	2020	msedge.exe	83
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84
PID 2020 wrote to memory of 3604	2020	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/folder/HZ43QRzK#TtqMnisZc9e9CG7Xc65qYA
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbdacf3cb8,0x7ffbdacf3cc8,0x7ffbdacf3cd8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3880 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,14499713921567183586,9692770401182602781,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7
MD5 9828ffacf3deee7f4c1300366ec22fab
SHA1 9aff54b57502b0fc2be1b0b4b3380256fb785602
SHA512 2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942
MD5 6fdbe80e9fe20761b59e8f32398f4b14
SHA1 049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f
SHA512 cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 681b02e02507be4b42f5d11388babfcc0c4a82c8011be40fadb2ad144faba31b
MD5 610e7e4cfd895e7f8d2b45a2e2722dec
SHA1 24723352fcaeb65ff7b3ea0bf7835293dcbf0fe0
SHA512 eb3ecafff0b39560f87a9dc687313d3cbb8a321ae607daedae0cdb7c5803df7b518cd9980b2c89b93a985914c5676e36f60fc282a768ed8575ee548973eb996f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 188B
SHA256 7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18
MD5 008114e1a1a614b35e8a7515da0f3783
SHA1 3c390d38126c7328a8d7e4a72d5848ac9f96549b
SHA512 a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fa768d62dbfe253641ec5bce465a3781e9df2d5021ddf5b969b3fa21d3cce361
MD5 d6a992d37698646c84e1260332771480
SHA1 77687fff8edf56f943e2cfd9de0016b0ec1c6934
SHA512 02869981d081442c68337c9a2033d768d36ee70c8b78ae31a75cd5cdf95d3d965e3e3f075450d4331ca9b200276e683bf9e945df5862643313777cba338e4228
SSDEEP 96:nyZk3X/CH0kRt5wSv0MoiVmdHIRJUzm0WQyV+VuziX3wI3:nGk3XG0kFv0MAIzLLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 857792166086d6a36065a47061c7be99612b4b39acc3b4ff39b59f0ec785122b
MD5 0d6518450646844452e42f90f238586d
SHA1 d2f2b7c50f3f42db55a9c9f3d2a9873c631f1ac1
SHA512 f66f321cb6904b37379db4a07283daac95c3a2c35af5eb22e1345147b6cb8d4fb3189133133d2230180bea2f4713a544e891a6e81cb7c5b9107993bc57c6439b
SSDEEP 96:nyZk3XQCH0kRt5wSv0MoiVmdOOhuu71jIEqJUzm0WQyV+VpAiX3wI3:nGk3X90kFv0M2u8hIRLLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b65cbb48333e741dde6f78d1978a1c3c1c12c6441a1ea3fb96aab5579b79e0bb
MD5 c88c9a1659cac3d068897597f5cd0b20
SHA1 646e5ae1b98fd8df03ce8e696fbb3278d278a0d0
SHA512 a68d028c69d4882f1d44138cb5119ae213e371b1e824a96ffa467160bb1fce19f06292af9e45e0d151b07e29f94ae17a46b295b5abc36cbe219f7898dcd606a4
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe582064.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe582064.TMP
Size 48B
SHA256 aa249cf0609d944320d0b3687abd24662779f0ffd87da41a3cd067f8a1513993
MD5 2ed19871771dc3446ff50d80d922aacf
SHA1 dc5c910090a443400797ffb79dc4745117540144
SHA512 8b7743ef711844df1d87eccede69d356cc449319e719592a14c11c2618023ec56b076cb29d022473b6cc92a297888a514e83c49c2e34c56bcdf32c6c3bb8402e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 aa23fd0028bca34683641626d92728f8359598e3dfe13047febcec5f895d42ee
MD5 697f1c434cfbac93e80d5a7ac8978f54
SHA1 8f30cc304a5044bde38ddd0a26f1fc26a0986c6d
SHA512 22555a08a107c179781db26789f5d8c5b227782fee0603df5f3ce55aaa3519636e962dd9f952163a125d776a9f2bfe1580591e6da4da428df26253c4b5b27e37
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGN1re2RUiTRcQprBoQ8wx0YvK:M9iIxuERzA83h09RZxASGbfm0BoQQY8P
MD5 SHA1 SHA512 SSDEEP

Submit Download