hxxps://mega[.]nz/folder/HZ43QRzK#TtqMnisZc9e9CG7Xc65qYA

Resubmissions

18/09/2024, 20:30

240918-zalezssarf 9

18/09/2024, 20:08

18/09/2024, 19:45

18/09/2024, 19:40

18/09/2024, 19:39

18/09/2024, 19:39

18/09/2024, 19:14

Analysis

max time kernel
682s
max time network
1005s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
18/09/2024, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/folder/HZ43QRzK#TtqMnisZc9e9CG7Xc65qYA

Score

9^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NexusFN.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 51 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\HOTMAIL_2.59K.txt:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\nexus.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\363K.txt:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Fortnite Full Capture.svb:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 5 IoCs

ransomware

pid	Process
3884	NOTEPAD.EXE
3972	NOTEPAD.EXE
1212	NOTEPAD.EXE
1940	NOTEPAD.EXE
5000	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
644	msedge.exe
644	msedge.exe
2424	identity_helper.exe
2424	identity_helper.exe
3636	msedge.exe
3636	msedge.exe
3324	msedge.exe
3324	msedge.exe
4044	msedge.exe
4044	msedge.exe
2040	msedge.exe
2040	msedge.exe
6112	msedge.exe
6112	msedge.exe
6108	msedge.exe
6108	msedge.exe
3560	msedge.exe
3560	msedge.exe
1672	identity_helper.exe
1672	identity_helper.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
5780	msedge.exe
5780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 47 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	1948	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1948	AUDIODG.EXE
Token: SeDebugPrivilege	1716	NexusFN.exe
Token: 33	5784	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5784	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5000	NOTEPAD.EXE
3884	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 432	644	msedge.exe	79
PID 644 wrote to memory of 432	644	msedge.exe	79
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 1216	644	msedge.exe	80
PID 644 wrote to memory of 4980	644	msedge.exe	81
PID 644 wrote to memory of 4980	644	msedge.exe	81
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82
PID 644 wrote to memory of 1160	644	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/folder/HZ43QRzK#TtqMnisZc9e9CG7Xc65qYA
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbec733cb8,0x7ffbec733cc8,0x7ffbec733cd8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 /prefetch:8
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7004 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,11386387482543970914,11059733086513789986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2084

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:864

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nexus\proxies.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:5000

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nexus\combo.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:3884

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\HOTMAIL_2.59K.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3972

C:\Users\Admin\Desktop\nexus\NexusFN.exe
"C:\Users\Admin\Desktop\nexus\NexusFN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nexus\combo.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbec733cb8,0x7ffbec733cc8,0x7ffbec733cd8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1772,7733215734546026408,8076889977183423976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5784

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\363K.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db1dacae9540e883ae83489b18cfc326

SHA1
ec3b68e635d8ce3bdafe258bca5187536d43065b

SHA256
3427a8a3b4868bd25a231ee8fe0ebada0b3474f2d8dc0fdd01a8931a8700a37f

SHA512
2e40df3bd1a045c69173f1a169b7080163de8f62a44d41d46c28f1643943657c532caa72f65b44a2175f976fdfd3d8328d989e011730aa851aecbcf02dde4a95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5aa716bb5a622ffc067efc6c85456523

SHA1
f5915fab4898e2586ef6bd7520513ba3e122b936

SHA256
4798ec5f836964c639ae9887ac54abd8c1ccab69b0991dde8575fdd98e82a662

SHA512
4261a0dbd475e1eab5ff67ffd2bdfce729dd81b300999e4a1f40c9975b28d2ad9f4f30572e38f220c191a79f627a3565fa5e8d0baa808aa51688c6a3dea1fa24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ca5e9955524c9823b048e60ed6947ab0

SHA1
aca389f7f8abd8a414c75b6edc7d9b4b4f9867c4

SHA256
06fc4308be85717134d406c5926d769e72b50956c2b424131bb2b3416e7afd8a

SHA512
63abe46140b6e9824f3cddd85a4c39ed8efbb54bf5d3872e8033f7bca698ae9ed10454d8be73500186e701462584f516ecb06acbbdd2a6a02d6dca7616002818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04aa3f476e468ef3c0866e8dedd8f6e4

SHA1
1e9fa8fd586c03447a4c5b4cee261900e9f464ae

SHA256
87b74207d65f6745b38a19dce13336ee839fb4d7929fce446c3d1177aa80c42a

SHA512
7d860bbe9c847ea0b60f210860d865f1e936aa2210a6f9aa87e9fd72f992a022ecb9a1827212eb9b97dd7798540770f55c67362714d90d0bfd080ad1e5e7aaa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
42KB

MD5
1e839b4744ad28d6e340113882563fae

SHA1
89cb26bc12ca7316dbfdf0003b8422a1bb1e8e19

SHA256
beb665068f875334f864278e14622ab0228a099461a6d7af43c75272ba158953

SHA512
c2ed45f74099f29d40142d6a71f5b1aacabc362975b78b1289e4a02d317b1e7aba1c093fb1c87c22da63c2883088a00bd9cf8f22572b29719197fd75c536fc2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
21KB

MD5
b1dfa46eee24480e9211c9ef246bbb93

SHA1
80437c519fac962873a5768f958c1c350766da15

SHA256
fc79a40b2172a04a5c2fe0d5111ebeb401b9a84ce80c6e9e5b96c9c73c9b0398

SHA512
44aefedf8a4c0c8cbc43c1260dc2bbc4605f83a189b6ef50e99058f54a58b61eb88af3f08164671bad4bd9c5e3b97b755f2fa433490bef56aa15cdf37fb412b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
36KB

MD5
f90ac636cd679507433ab8e543c25de5

SHA1
3a8fe361c68f13c01b09453b8b359722df659b84

SHA256
5b4c63b2790a8f63c12368f11215a4ffec30c142371a819a81180a32baeb2bce

SHA512
7641a3610ad6516c9ecd0d5f4e5fa1893c7c60ca3ba8ae2e1b3b0cc3a72f7f9bef4c776a1f2fc52f366bd28a419ae3594a6576e886e79a20ebd98b55b2acc967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
37c3037ced6aa2d04ed7d070c706270a

SHA1
332cf152af3c64a0671070c87acede962108022a

SHA256
aa79b36f3bc28de6c8cdcf5044807cf0a66e60ea307937f8a89e3f139ae554d8

SHA512
8806762b0106c039be42bbc5131456fd157aed379b4dc40ebb26385f2c9a20704adf2b9dc219b6e6fd50ebc8a6e47b36eb86013d5c44140196db8628764e1301

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
64e152249df36e724c26a5d0b2a470c8

SHA1
f14cac308b295b46ef3eb43c35183b456e91d169

SHA256
9999439e5cd4101241e33a09b2b7f1378cd8f6e1fe351c06e969e5caa5c32033

SHA512
fdfb0790ae8463308d368585ced38517a8bc3e820d44466f98e6af86309a90565f31e0a770af4bb54e6b514c9713c006c2e3bccfc99d113a0da0b5c55a22dabf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
e7c6491e9eeda0e1b02dd69f0739b0d8

SHA1
0eadd404ddcb62fcebe321ad8fab550c499d3715

SHA256
c364a8960cbf770623b60c69c8fd6fb9f3012999dd049a70e7f9e71182f42215

SHA512
15df528279f7ac002ad34799891aaee073b886b8f1559fb62ff3344173cfa5e6559c2f8a393f3f9eeca7250efa817cdfda34c23711401817a54a2300642aa691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
f3a8ba6e8d625e4e5743432a65ba53ff

SHA1
77a3c847aebad7767ee24fd13a5f88b3aaa727f5

SHA256
adab5e6aeeae44313beeb21c629a7700828fe4dc2aeda72894607203019ccc1f

SHA512
bed51df45393f345441ca734afb8a6b6d28817684e85eb1e1a8f1b582f3e1acabba95085684d73128906c6502c27577e1ed42e4ae0317aaf7667731c8df7c7cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
28KB

MD5
208b34f6f57bb96939645992a4cf2ef3

SHA1
cff64f016df070d10edc8c0f8fdcda8b5a191bff

SHA256
9086ba9aaa02910e130744552a281ba90510d148ce7ae81afd46162e0b22f82a

SHA512
f082d79da94d39ef360a596b18ccca5aee85bad6d1bdbf0f70a782d31a0b645e5a1351aab446d1925ed5485bed2189784e813fef0ba5b3a199daf9a109d632f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
116KB

MD5
9b6a87e4a3c779e03cfba6d7bf97f7e1

SHA1
f5737fed2881b0d013c1f3668caa4ce08d3626e7

SHA256
0529633bd9c3416fea49478599d69d2ca2235f09823a3dd1b48fd980f7d366c1

SHA512
d2e9c0c9dde011d324792b4a862261812d4969a4154e213ccf86da417ab83d1c15eb0cd75511c88c2ebb416fc149373b26b25c8d9cb98fbaa49ea02668fe3e40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
37ec1cf56ed210bd733ff9e987c60315

SHA1
11b8a71ff4315367ca3c23476e91f4e3e5e0f6ec

SHA256
ad16059d730e0457bd0397f02fcdc1cb04d04921bd31e22851a763b7080d7b5e

SHA512
06cd26e3cc8b6d859f04bcd2879a508908b2f252aa4e3b7f9ac2ad1df5aa4107f5341c0470dea427236ea55883e0cff232197c9a9db1323342aa9759755a843d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3d18eba15023a7ab020ebe9643e385b1

SHA1
f55cd19b0dc636d6e746c7829434df282d5f9d50

SHA256
85618f8b9ba0b5fd3385b98295153b09c61a0651198f2cfcb05866258af3bb5b

SHA512
44c6e885d765a5637c1e81bd79476a5d308823785f6e47d7d3b324a213297080f39cf75d3a44c9969a8123dcf218ed8c9b857965b4bcd4e3a801d212932ab999

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
89e04c4a3b35700c349774fadbfb41ca

SHA1
fd6de8c29b6aea5e70e3e2140bb3ea4b42bf661f

SHA256
36d9841dfe7090d4239419d1eeb8a366078d2b37feaa3f178d9875e291794bac

SHA512
023f3306e217d684b30f94ffb7c3c6f5398a83b5756968f687ce2ce824462835a8443cb605948b69c9a3a43cd27c927c6f6a87a7405dd8359ccd6ae5d098eeab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce5b00047ddafed0ed27a7c2515dfb94

SHA1
fc30cf96e2d697441372f304dfa1acd8fa363c58

SHA256
8ecc49536fa2d47e9abb0559d839ecbfce8fd05edc32a663b59b50fa3ce058db

SHA512
6ef83e34cae2847475ab5661878660c179e36cda9913fe1cc87ac5d97b3be5ed2a6feefe5e096927e72510938c0edcd78935a546416a1af97b29a2724ccfbd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
54a6acb917e9808c0ff14a524faa00c2

SHA1
44f57ee31f4d44837545dd21f430cac5c700ec74

SHA256
114b8211a0a5a21eb9da9f177acf9aceac967399057e32127041b79cb48c9d42

SHA512
36cdf6bfdd986ed981062f605b5a0774c405923c81dedbbbbf41e85fe26c145c496962edc3cd0649e1e35162740230652a6cbe3890db5d02fa9a86b26a7b6343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
915bf1506047d0141a28e5ae1f6ef50c

SHA1
f5f0f8e4d5cd4aa5c5805d4565bc0501cda615f5

SHA256
357de7ed4bee3036d3c28f481e9aad04ebc93850b6d5cfd0d491c616ab8af527

SHA512
665e9b9c9a7176d4fef01fd83c6461af2628b69e70f829524020805949d115fae5ca7220705ee9044a9f5a919bde29bfdf4bc3718f546ce2a25df4c1b8b70d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dfabc6ab8aedfc1f814521581754775c

SHA1
248a4b32a3bb14526e7964d09a74a43dc9569657

SHA256
e9f21b318458647a13f8356aedd31fa38274f2b6a3d64a18d16ffd4e275553ad

SHA512
3686c55c47d5cf02cc520bd1795d86ec4c7859f7278171e066aa85ec93c989f9578f1a200c37ebe186d0930e915bf8f1169fb8decb1ac2cc3deff07e2e90d303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
732f66fa9fc519f05a84b17c8796b170

SHA1
cd99fea75ecba2995829b198266883b642bcc37e

SHA256
02e13c56ada007249704b92631f2c330c829e682c9c3176ad8399f508560222a

SHA512
b2aa15a212ba1701f40396e238924b242e49f66bcd3f0b34eb96928d2fdbb9bddc2bef736d5b4c6a2b9e610562c65476584847b5f60e9a6477def023b9eddaca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9bed82f3373bfde8223678bb2270f60d

SHA1
21a662bd83ce59de0a92829bdb1245d2cb9a50e6

SHA256
166710b13cfa09481fd32e5f8cc0a00c1432698613ad3896cea965e27e25f222

SHA512
c890f2c76df74d5d915232fa3a55d02f7ea416ed8419fbc946f10e4a1e1fc4f52836f030ede3df762ecfd70290f13767e09fa59de8fb8b90c758164dec9e6673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0261fa7a1ff4835c35ae356415bbf73e

SHA1
3deafe854da04d8a600297c5d2da70709f3f95ec

SHA256
498260d97406f3aee7156afba6cccbefb19ed5944ee745efeafa8fb59c63d262

SHA512
5051f502c7841a57a30155ed133e227554d2abab22ac69b223bc093ab99da8062dc385ecf1239c63afda3d4d3ac689d53a23a9cc1c049db8d23d310da9a43c55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0e9207de29df6500cbd870e498c4b7bc

SHA1
ca4d960034ac476d3a1d77aebf9f65e03405e671

SHA256
916f97b429395cd730a3f8ff1d2780c06cca883b5d23faff7f2d9a674ea328a2

SHA512
42a192aeca8f7bef5e8ede6fd1430996f7c016c40e100ec0f70fba60244f3cbeeff392b5b264ebaa393e701b74ca5c222c28b1ed6f96fe2e5778d2a26307a427

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
170d2dd5bbcc48098040c120fac01d04

SHA1
be129a07fcd24c67db9687fdd298415e87b5aaec

SHA256
93e2d783e53fda37970d37a4faae5f172edc49f184ba2c63808d0d355ca4c2cb

SHA512
bba90ab90c1ce5eb60d5d67d2bb34b3478ccef71fe367377bb4e12f96c6f89097399ae5192f601691c9f55944d55e0c65c55830582e83f2204fddeedf6d9bf98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
68bc3989a8030ec0df1b6741fd7f2eb8

SHA1
3add539dcda1edeb7b0dbfb76c025934704cf012

SHA256
bea89021fef7fdef0ec1cd9f27bad9bf0cc309a840a6c509fc88171de89e2e65

SHA512
e8f077646553262fd05a6e5bd41e2fd210241047995725661212b43c41340498fc8dbc8d1efd0eb2dae6ebf5533322dc0675dbc9c1a9edd711f80e50a33973a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
85493333d504dcae41db8ffe9977f966

SHA1
a0868428c400c2a815aea8583b210841bc2471ef

SHA256
115263ef914bb5b87c092e3740b329f4e3a451b2bdbd463dd152778da045cdfa

SHA512
72e58117c5c9a15ea632185a68141fc5c36c406110236713fca9ff9ee0e77617160bfccd389a6155956f43378c4702ef8d52786338f9b3f32db60d3c64055a85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
a34680f8b1266e2832acacdd5974cb48

SHA1
8ed0a05cd9bb03b4990ba77cc79662cacb1e9700

SHA256
cebd372ccf5372c18ce3b746cd8dff2d0e01ec59542d1b3079887f9a8d1d1c21

SHA512
6e4739b7489525c9979dd92f7c480d9574b4215aa92f65edee6e5db9aaf555d9c0ba578d6b6ad92c839648060157967e97a16fdb9d66ce173db6f7c82dd8562d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
761abd4047727131a31c3825f696dfb2

SHA1
05dd363ec1c3669f72dbdfe59a8fca2c236babc4

SHA256
2643b77d60d3366cccab38d4e079be14604e1e2043a8d4f4b9cb036da78bf18e

SHA512
33edb9be4679d1809a97eb3f3404f76263341734eebed91ae28d2152b574a5aa26b0fac6c6891626dfec86404e27c1f3f76b09ada0af35ec155eab733798aad3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57cc78.TMP

Filesize
48B

MD5
b2ac7e50ff5a6c7859ff781c14eff297

SHA1
804b50c857aad0c8f88510f87126fd7b1fe813a0

SHA256
26ed96a85be9b01b63ca46539cd4a2845cf6341bd3d2ab00d4174ff35a06536b

SHA512
800ca94730bce801469702b4621691ec84ecfd25e684d40b56e054dcf89a43c7223cfffb3eef3237cca999ccd71c20f2548ce20482547bda3f0a0235e5b5ab37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13371165164249084

Filesize
130KB

MD5
8e87c8b8ef24fc6d7a2f69b93f0c69aa

SHA1
f5e8b56fe92d46bdd7977800996d019730b11c7f

SHA256
c35f9af29d8f353d8b2580aeb349f7402fd3ed67757eca23f45f61a3cd86ee43

SHA512
5aa4ccf299d95e12d6500db18b3ef030b0728b2f0b4acb3c57f3c582c19448bc6c064f97ed623e012152035e03bb14cc1d2083553d8ca6b375747337ce959640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
328B

MD5
11e03ff012315d11d01a0f571d81a392

SHA1
a89a770baaecd2c7d5f692d69de69bef317aa18f

SHA256
aab07c1dfacaa78b5a4339d3e9a0e610b21186853517f933e85b74ec66c0e5b2

SHA512
de78d1d8f802ca62fe50ccd7cb5a0404caa8b481b3c8ebaeea01a7196bac9b5acc21fbc633e4e65d2ed42072774ed57f04ecad86d8844646fee522c366a37726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
c16aefdd10721772bf7764d42ff54f2b

SHA1
1814df699d06d8a5a3b26547e8e8f2d83ec5b885

SHA256
adc13bd4d2ee97a55ed329be2106f1f59c4da22ae22c4e74481e963c0b9d31bd

SHA512
0867a50639e044ee753af1ee991050063534a6ade23c8586c7375e518265fe8d44a00bac6e81380c3a39445e9542333cdba6062a4d67bd9a6ee59a9a81f7cdae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
aa151613b8b94af1f3aff1552ae8fc66

SHA1
ae908746a13b2e4f914b136ca8f1b58cae564117

SHA256
65df924c79029e665f616874b9e254377ae64e544198aa13e5fb2e9191bfeca9

SHA512
cfb9da672c8d2cd4da9c0eb931895ffbdb909026b6d6d14f29c45afb9f8af71c975d55bcfa67408fe3a92202777d4c3a738a2956fdf9f7fb7847ac3320c7dda9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a48fd820cf9fd27a87acc7cbd3597fde

SHA1
9c4bb4115e56e6b3c128c6e2f2bceaebde3d1899

SHA256
feb246bea9e19f3c5d0aca232130861783039e2ee9844084db263c3afeccaa2f

SHA512
e31249f5dfffcdac099e6b24ddc9fa9cbad30c3cce7d4d8f59f6f5117ee99e7a7d0c24eb70198022d3deaf9f13615891c8e0f617f9c411042b9060dcd1d13976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
703b90988cd3a6460209417d8b754e1d

SHA1
1788070ab5ba56f1634c468e01a81f40884fff89

SHA256
d2c8fd05fcd430728033d45bd0a860be28fcbdd88b87acaf267a4daf8b324f9e

SHA512
45992163c6ad73d9f6a2e6ee63839c90ee3688d0f42e62647afc6f36e12c225520450b87b3dacfd52c7f20c993169b3bbe7ef768f1754ad7120ab7dd7d3f735d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
65a0a083fa401d482f96ada31baec585

SHA1
524fe5f2426c0c1f5c38deca633cfa6619e7cddd

SHA256
1d78560dcd581d5850aed475b2580ce42b23000222b41a84e523e01bc9b11477

SHA512
31ca7f91894a1b2dc4e60a9c8d2c66ecabe89b4697324d8024034b35462b1cc99a0a88c47137bbbebdac717b251e39193ba6bb92e38c61191e3f216739b9601d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ed124c29903838c69e95656fb0b0b513

SHA1
e29ca29723a5bf79716a4e302161235057062928

SHA256
2b0e50d5f15883e4fc576f8577675c9c600a93df4806f46b9a688487a982355a

SHA512
a451e82df264e84d16ee2dd65fe500d32aecee22c1b9d8720bf24f38710f6d0eb7de90155cc744981ef2e819899b4fd68d938f4ff2ca7e0b2b5a66dcf4937208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a3eb2845502bcec81246ff60c470ae72

SHA1
f0322480b45b7655bbd56c1da28f1ba340e21d61

SHA256
3ba268da679c0054d12ada9f4cc79636a2a796ec9105b956098abd02fe4c4946

SHA512
52ca27436bee5ec7f2181a23e217adaa414d27d996d8cd5d97922536e9cff1efecb3d86c0763d2e8ccf31433b21219000d6425d8e5f026fcc14e602267e1667b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
044e196704095eb00ee168e411145df2

SHA1
c24ae8688e23c434789b40bfd06ac1c0d05e8973

SHA256
85a27a08872ed8e81386ecc60c89b7f859940c9f6174c1a8302d7206e70ecd1a

SHA512
035a03713eab16f1355ddfae4d8226a2a63d87592ec7db1d7f8115683c27436d91900e7cb368b2e32243c274dc6abd195108522872fed2a1dff04aab80c0f68b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587589.TMP

Filesize
203B

MD5
904d89399877716ebbf748173477880a

SHA1
59138c899b846af21cdcbce296d7c48531655cb9

SHA256
7c78550a578679b1fcf268dba62cffe6e9465659e8aa6a068961c56efed4f36d

SHA512
04656a0e2aba7f7cfa712da2d9562bc77fe9c1fbaa46d2596a6c24d3bcd8be54e19f093d20d28fc62c2694cb556e4521f5468f247db9370ff15e265d00998908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
c248301851ffd0198e6ed04f88a6c345

SHA1
b2026a13d3dfc3076acbb7e7a62b2eb8a324e865

SHA256
b51a0680a2f656dabe5bc5ccee16abc758f435fefe632aaee53ce571565b7b23

SHA512
03c4cdc8a7267e3acd322f5a08135bc78f158e8cd6f7a9cad4a050673046f3017c4d3293be4916abf851c1dbecce96286547dc45eb96f5c3ee3f11594443142a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
112KB

MD5
ea33dc5ea6e970480bbee3b41734bd5a

SHA1
580e98a79a9c2dce4cf775c5230b405b114b1962

SHA256
e8dff65368e460f4368dd84e67891b0804a9de3d3f30f3f75c403cf3fdb256e7

SHA512
ffccb701d10f03c60bcbcf2522067bb422a60a722c6b8627fd08623969eb940823db7f35f5375d72c6861fdbb036b962652250396ec3f30be6ea022a71e0ddbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
03f4a7a5205c5aee76c8dbf7c3ebe5cf

SHA1
a0a3707c0af5b8576c011c0fea43117403d6dc13

SHA256
8a09fc2172472e171136b8833cc687c65f82b877f4e14052aafaaae17c6646d3

SHA512
6a2aa89128608496bfe555153f0a23e414ea42dd154b56642c2a3aec752f55e1ac1e2f146354018f78d84a3d4111988942d76c255069f97bccda596d1ab15d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1c66d9e843c1fa13727413d5e1a02a54

SHA1
cd66c0f2c17d2f9cdbed9568e9b28459239f8190

SHA256
4e00944ae86dfdbe150ef9dfb11f78ac9e98b5269359ad2b26af74b875cf9c1f

SHA512
50701dcdfbb49a7c3ac78fc1f63131ca0f285b052868daf0fcb4f3fe994d004d9e76f33ea40751b1d8d6dc0c19c62a02d113646bce2668a0a278a77454808639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ca5c0aa1d645cf0e4c77e055c7d9c0ef

SHA1
d3e9150a1c00744ece5b4330b6222f3f879d09d0

SHA256
295852ea063d549b78aacd62dc6ee9a9b17e574f4054d9f1ee2b9b83d5bda885

SHA512
940c4d4e998fdcf5e755bed5e4162ca888c101b945a1fba0c45cca038dfbca403ca2219dc2a5fe10c273fc6dbffccca3fb11e911e4f7afa0dc4f215af8c271f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b437b51e779e336f7bf747f40045dfc2

SHA1
4490776caa62e125f196f8132dd04aa43d26f8a5

SHA256
9b23175aec9b3cc2d5db088f94f93e8e3baeba8e203c602f850cc031a66c4470

SHA512
0d983feb744c96d909918642adf80139e5fcc2bea8d4d15fb61016ae46d0d1052bfb947c772b925e97cac48004804ac0e445a32705bad1a95034f4c4c5a1ea88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
a9ade234f9e897fe3534e668af12bf55

SHA1
7ce4c283bed325e94a303cd3baf5552f2622d202

SHA256
cfdd2bd7b31310b08bfc4756e64ed1a28d7b64f97515d168a758230df383dc4e

SHA512
bf2fedf5746b3634444cf76d6b6fbfde91b17530b4d56427b08af6b43de7d85f705cff863ce80574353edb61e54efd4eadb18acb4f58e6cea1a714f67101871b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
2281e3fb5773b5383728124be15f4cb4

SHA1
f7c25f954ce86ad793d4206a3c3cd7b9c816cbaa

SHA256
da2d3d67b76da52a5c0639c5e666db10adbdad5243119ca9044445ef704ab4e3

SHA512
7f268351681f817d9613f00d64520d1ade835f991a35a0a597a2b32eab14ab0c2f1ad4deecedaa099121fb82d6be405cccf35176fb9b635bc659cf01c69a69ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
2a9f233d0563554dbe8c4fd7caab652f

SHA1
0fafe0347fa0c189e4cbf9974452ffab2021c92c

SHA256
828c9e40d6ea465c49e6ad6ff9fd6d92f3b97bf37f9302dd06018b4fff2b042e

SHA512
b644d60dccf6d1739a3c811cb1a146ea4f74c5c5dc94e261a486afbfedaffb51349e135d04582bd68e19c3acb5cb9fb275b842b60c25c93bd5086aea68ef54a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
8a0f14c248c9a96112ac224e26e52ece

SHA1
4d0793a2a5856480915e02132431db818564f2f5

SHA256
bcb92c024a89988082a80e87d43066134ff4b3705cc4aad1842283badc1dce08

SHA512
9f9c59d1b5414a68eb09b1d3cd0990cb34da46494ab0e3ada1cf086e2f6c35f25e995c9ab6b246b51cedd5a732d9003495ddc3e47f9c5de38194b69a5f670e7f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
547551905d2bdc3331896dec428be46b

SHA1
ff7a33d8a371fdc5fe7c120f5bd1e90992737596

SHA256
eb678c47e5a8f1c508046ca470d0633c01e111712f2300a6a4b254f53b1aed94

SHA512
24d193130b2825afceb8fb0fede4fd999d2172cf071eff443a7b07a62cd51fc4da17ca64a933c78357b9300dc421c90872ceb9013fce7de28a784708015ab9c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
e9175e6a9df5acc97362026d04f13f3d

SHA1
cabd7a7fff3f7270c22a889258de2152466fadce

SHA256
5ad5fb76369173ba9a613687943f6416ed454c520dea9af6e0331eb7164c7869

SHA512
94dcc15c186e1bd1ebca3340e52e7737a58374893aaf5ed1a2e3f4d78bf09ecf651c2b99eee10499e0e546e22dfc84fc473fb4274101ff3978a5971019777ba9

Download Submit
C:\Users\Admin\Desktop\nexus.zip

Filesize
369KB

MD5
a9bbfc89690d3095e180b07c6d1e367d

SHA1
e05cfdcb8701c3d9e3840aecdd77516572bc0278

SHA256
a66f58a10ae4cf981749ae70edfbe2759c93eb6eedeaa332c8dfafc3c89e8d53

SHA512
4d8358b3b4ed88db446d819d2e74fed91f51b68f9d9b2d8c63b1e0a1d223b6e044030eb4d5824c1fc8d4cd05ad05c1e684b05623485383d5866593989436d3a9

Download Submit
C:\Users\Admin\Desktop\nexus\Combo.txt

Filesize
94KB

MD5
64c8fba4e9664748f3af189092b1b174

SHA1
f9151b4ea357137301fd9ada996d7b882108beb8

SHA256
f0add92c523f3aed80f300d62e9f77c1fe2f8f7ac76c518f706095f08c63576a

SHA512
ddbe3384bf820e4f36535cdeb8f27646007ac51d9a296c5c51bbd89ec14b33cf6291dd11ac3b7597be25632825125c399dbf66830807865ad44cb4a5a9995ff0

Download Submit
C:\Users\Admin\Desktop\nexus\Proxies.txt

Filesize
8KB

MD5
7a76216cb1a5d9f685d374ec9eb3ee92

SHA1
794d2fcf4cbd1cc6fced6ba76b89d33004498297

SHA256
96b7e2720b3c573d009aa4e7fb560c74264f077c8fed0e5c78b45e2756d9b96a

SHA512
94e3ac3a8434932cc3e01be0e2c522e3d9e8775407fd19ce6124932c3696b4a893c8d5b554ca3d6414918e8a994871a65a4993f369ed0c68ecbdfb4accec44c2

Download Submit
C:\Users\Admin\Desktop\nexus\Results\18-09-2024-08-35\2fa.txt

Filesize
4KB

MD5
40181d8504b148e1c41882bf219c65df

SHA1
30beb079ad7d6f929c5f4398ed7ab866dbebf73f

SHA256
104af7803ae4983bed97f50296242091dc2442f09f7e3454ee5c35ec01d69197

SHA512
abe2b162c7fe365c703ee4c9a3e1535401822008e2ebe0650601250992f2a52196bd87b6b833fcc736e8a6d18ef6beb57c90da20b663897632e1d554d0330a31

Download Submit
C:\Users\Admin\Downloads\Fortnite Full Capture.svb:Zone.Identifier

Filesize
52B

MD5
dfcb8dc1e74a5f6f8845bcdf1e3dee6c

SHA1
ba515dc430c8634db4900a72e99d76135145d154

SHA256
161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67

SHA512
c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d

Download Submit
C:\Users\Admin\Downloads\HOTMAIL_2.59K.txt

Filesize
94KB

MD5
a4adf32c9a57b6909bbb8b0a0af6b4cb

SHA1
84143b9fb39259ce660e3be1a548ad5652b76e7f

SHA256
254d0e9136e17a83edbaae863bd3175f484b88ff2acfcbfc2597ad56a3a4a612

SHA512
21c903901f6c5594a7c7f2d0bff12bfc229a488dc4673430bcb29845259fb975a999d80b8dd1b52eacde2b6c9e526d2a7e46a0629abdb96b408bc8add4d54817

Download Submit
C:\Users\Admin\Downloads\HOTMAIL_2.59K.txt:Zone.Identifier

Filesize
120B

MD5
c6d8b808e5c8f002edf8f174f1e7fc13

SHA1
2592db754116a95f5f4428ad3ff7bf95054abce4

SHA256
65daf94c2e45e2fa8d2249b1a7e6f6fa86a3ad40f2907993871036adafe33022

SHA512
7c783434ce7b96062297fc416adf8d29f58471d7c2261a24b329ee10823d1a1b02585fe261fc4d53d43f29a459cf56275863bb0994398f963688d33b2736434a

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 633182.crdownload

Filesize
11.2MB

MD5
553299ccc9ca11080b5ee259950429b1

SHA1
b4f977c3552c78d3fb083778b6e0be1681c2f44d

SHA256
7be2f24997cc2e12309f8b5c03fc88fcc1f60568241225c23ba462c31b80cd8b

SHA512
34237fadcaed9e1aaa54265a12f161ed340bb83f619ece0cc8d1989d23704de57f4e4a5e1c2af2f1dc4d52f5055bffe14d4abda3edaea2acb9f8eabdf41e1974

Download Submit
memory/1716-997-0x0000000000AD0000-0x0000000000AE6000-memory.dmp

Filesize
88KB

Download
memory/1716-1002-0x0000000005670000-0x000000000568E000-memory.dmp

Filesize
120KB

Download
memory/1716-1001-0x00000000057F0000-0x0000000005866000-memory.dmp

Filesize
472KB

Download
memory/1716-1000-0x00000000055B0000-0x0000000005642000-memory.dmp

Filesize
584KB

Download
memory/1716-999-0x00000000054F0000-0x000000000550C000-memory.dmp

Filesize
112KB

Download
memory/1716-998-0x00000000054C0000-0x00000000054E6000-memory.dmp

Filesize
152KB

Download