hxxps://mega[.]nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM

max time kernel
103s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19/09/2024, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	2816	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NexusFN.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\nexus.zip:Zone.Identifier	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
2528	NOTEPAD.EXE
3108	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe
3868	msedge.exe
3868	msedge.exe
4436	msedge.exe
4436	msedge.exe
1176	identity_helper.exe
1176	identity_helper.exe
4576	msedge.exe
4576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	3484	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3484	AUDIODG.EXE
Token: SeDebugPrivilege	2816	NexusFN.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 1360	3868	msedge.exe	79
PID 3868 wrote to memory of 1360	3868	msedge.exe	79
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 4368	3868	msedge.exe	80
PID 3868 wrote to memory of 3452	3868	msedge.exe	81
PID 3868 wrote to memory of 3452	3868	msedge.exe	81
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82
PID 3868 wrote to memory of 1072	3868	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/8zdVADbQ#zgBChae6OAWDlXIIXvyN2uTShbQUcxQkIfMD9eQhdQM
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffffad03cb8,0x7ffffad03cc8,0x7ffffad03cd8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,12491327086055690928,18124047972648536022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1104

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004B4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3076

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nexus\nexus\combo.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2528

C:\Users\Admin\Desktop\nexus\nexus\NexusFN.exe
"C:\Users\Admin\Desktop\nexus\nexus\NexusFN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 1300
  2⤵
  - Program crash
  PID:2512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 2816 -ip 2816
1⤵
PID:3744

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\nexus\nexus\combo.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4ae6009e2df12ce252d03722e8f4288

SHA1
44de96f65d69cbae416767040f887f68f8035928

SHA256
7778069a1493fdb62e6326ba673f03d9a8f46bc0eea949aabbbbc00dcdaddf9d

SHA512
bb810721e52c77793993470692bb2aab0466f13ed4576e4f4cfa6bc5fcfc59c13552299feb6dfd9642ea07b19a5513d90d0698d09ca1d15e0598133929c05fe1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4bf4b59c3deb1688a480f8e56aab059d

SHA1
612c83e7027b3bfb0e9d2c9efad43c5318e731bb

SHA256
867ab488aa793057395e9c10f237603cfb180689298871cdf0511132f9628c82

SHA512
2ec6c89f9653f810e9f80f532abaff2a3c0276f6d299dce1b1eadf6a59e8072ed601a4f9835db25d4d2610482a00dd5a0852d0ef828678f5c5ed33fe64dddca9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
d5a7a56b0c4960df03730258c9ea7994

SHA1
7570ed5320fc5ce011c190c75a99f21025a98c82

SHA256
9e9056f1cf0aeac3d87d7b02b35b833347564b16ca6b1b1cf8df1cc6536c486d

SHA512
585f63da0b5a7e227e17d51d75f00b9576597c0975768998516a913875099b31917ac845e3016b0ce6baa8ddf9b7964e4deddc33c0d0faa71136500f489f58d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a7561724ad0089afd41ce91271624b76

SHA1
37f90b06d68b840a44bd420d08ebd314a16dd0a6

SHA256
c71096685ea347b65385f69e7623d58f433f0cbe30395fd9b9c947563ad21999

SHA512
71ca0ad9c7a15e6edac4d8f96dfb56b749d989cf1d6c3283809d2842a5782e08a96b8d0db690af81b1a79c90fa1fc69260e7c4710725b2e1606b031bac9e0597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c85b30149587c5a12b71e6868f6eaf29

SHA1
90c7b418e4a6a3383aa341ec586d74a642015631

SHA256
63a1c5b38f6ff34c3e3502b3fe45f5df807bd2c065cff53608f6a79872384e23

SHA512
f9096e2106f6ba496818b3c9d22872380962da434b1de931e68cd7776a2bf41dce65efd2999c02d241da9a153e6d7cc04c4b587091b349f655beb721f9e2a7cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91f79b5fe1189b0f27dcce3b964daa3d

SHA1
8320b2e841bdd2c584ceded9544eb5c27fbd5851

SHA256
c1398a911f3a24ae031b4dac144e2951c08a1a0df1f5f3f56474f410f38979ba

SHA512
8a77d640777348957cd3f6a3fb339d8d9e3116f70e4cf4810af9ead1f09183200ce02bffa69ade77e4ec798e7fdbfc9c340b8c15591ca870cfa8c098702481b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
77cd6b61360c4cdc3d0924f1adef6e7b

SHA1
bc36a7259d85756c5e4a4fcd9fd5f93584bf3e34

SHA256
d55cc011c1d457e5505023cf6c4152752c2c66bebed7aeb85f65ca0a715419a0

SHA512
537112f80a510e12c5e2977d999be7848e328b46b35fec755fdc8fa1024f26c1e89f7f54dc3c6d3d54d22f49708a32ddab01d1f47ef893073a6fd79809a7fdb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c2e2.TMP

Filesize
48B

MD5
a62fdeaab528599a0d0ea13c3fbdf78c

SHA1
b59699161494a9f851a3c0b2af0026832e5768ae

SHA256
3023563c04e9dc4e6b49f2034cbcab30e53a7dd5eadfac5128fecebe7af52d06

SHA512
1f62c0849ee19212a7ffcfcb928c6f0f534f2cb2ee5197902e0da128c8a2e24b4965ba01f61243d68a8da06f3d184d52311611aa361ebd915b9d3a676092a73d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e3240bd165e9cc85cb335a249ea9f520

SHA1
235f9a5f3f3b9273d1dd47ceb3172639680cb7e8

SHA256
12a14e8fd7bfc3249fc142cceae5a6ada83272a4a11f5cc188c1c304a853a0a0

SHA512
67ac96d7fb3f85aa1b8a070aee145e75d93f7a434d469258d9fcf228d7d93b0ae4cc4b1c1deb13901e7d53cf117f3828adbdf7a517bd02962653098617b27a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8e98d209ca97aae3be5d9de804e372eb

SHA1
2631fc86bf81bc17c55cc9aee15e21c3b7eff834

SHA256
c67b222984b903170fa60dcdcc5eab2f508a5e74f2f87318e7fba827149c2d32

SHA512
b1b10b08d9a7459b5a66aecb038d9d6ddb9906bcbb83df3261ab9c491e8b22648a48fdc5cb281fe0824083cec465bfac070cae5986e1b359c806bb4566d983be

Download Submit
C:\Users\Admin\Downloads\nexus.zip:Zone.Identifier

Filesize
52B

MD5
dfcb8dc1e74a5f6f8845bcdf1e3dee6c

SHA1
ba515dc430c8634db4900a72e99d76135145d154

SHA256
161510bd3ea26ff17303de536054637ef1de87a9bd6966134e85d47fc4448b67

SHA512
c0eff5861c2df0828f1c1526536ec6a5a2e625a60ab75e7051a54e6575460c3af93d1452e75ca9a2110f38a84696c7e0e1e44fb13daa630ffcdda83db08ff78d

Download Submit
memory/2816-302-0x0000000000940000-0x0000000000956000-memory.dmp

Filesize
88KB

Download
memory/2816-303-0x0000000005350000-0x0000000005376000-memory.dmp

Filesize
152KB

Download
memory/2816-304-0x0000000002DE0000-0x0000000002DFC000-memory.dmp

Filesize
112KB

Download
memory/2816-305-0x0000000005480000-0x0000000005512000-memory.dmp

Filesize
584KB

Download
memory/2816-306-0x00000000056A0000-0x0000000005716000-memory.dmp

Filesize
472KB

Download
memory/2816-307-0x0000000005430000-0x000000000544E000-memory.dmp

Filesize
120KB

Download