hxxps://wetransfer[.]com/downloads/dc6300ae31448384f356e0452b37b91720231021135934/9038bd

Analysis

max time kernel
168s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2023, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://wetransfer.com/downloads/dc6300ae31448384f356e0452b37b91720231021135934/9038bd

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000703abf668103da012e0c60768d03da01cc4bc9bb3304da0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1511405631-3522522280-778892991-1000\{FC0DA72A-DB15-44D7-A2E3-FB008BFF164C}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1511405631-3522522280-778892991-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
4816	msedge.exe
4816	msedge.exe
2880	identity_helper.exe
2880	identity_helper.exe
1732	msedge.exe
1732	msedge.exe
4996	msedge.exe
4996	msedge.exe
5668	msedge.exe
5668	msedge.exe
5456	msedge.exe
5456	msedge.exe
6100	msedge.exe
6100	msedge.exe
6100	msedge.exe
6100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2968	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2968	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5668	msedge.exe
5456	msedge.exe
5616	SnippingTool.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 3540	4816	msedge.exe	80
PID 4816 wrote to memory of 3540	4816	msedge.exe	80
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 1960	4816	msedge.exe	88
PID 4816 wrote to memory of 2328	4816	msedge.exe	86
PID 4816 wrote to memory of 2328	4816	msedge.exe	86
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87
PID 4816 wrote to memory of 3592	4816	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wetransfer.com/downloads/dc6300ae31448384f356e0452b37b91720231021135934/9038bd
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca29c46f8,0x7ffca29c4708,0x7ffca29c4718
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7324 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,9817380873268309830,13286699524029871977,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1332 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1516

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c0 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\system32\SnippingTool.exe
"C:\Windows\system32\SnippingTool.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2430f921ebfb431716d98779707a18a8

SHA1
a4296a634347c0c30b3e101fdd2a10d5a87746ba

SHA256
00f6f17a7fdfde9da965c8236df95a72c6698f36274a632908d22039a2a828d1

SHA512
8ceaae534e5558b6ef3f0db80527d8d79a1aeb369d3bca85d7e92da4ac5c9cad83e604e5f566e957cbf027192b1308c61098f7b493d5232efbc4a15082737a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d546331-29fc-4223-b57e-dd9d3653bdeb.tmp

Filesize
3KB

MD5
6e79d106ce4cb90e731449d7440ab9d8

SHA1
e24c0881bb747123392c9203ab9a6f38a5eb8707

SHA256
5a5a3149f8a9033d913a010aba051d10bb3b06727c88d98f4dffd7641783a318

SHA512
91f6edfc22afdfcdd32495b30d9c659254395af1a589df3620af8f5fc6a7b64107685a593d713201702165daad22d7ae071e28711c4a6bae70d0464f20daf19f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
35KB

MD5
5dd98a388fa75d4733debac4533d70bf

SHA1
f62388d8e9a1d7b1fbbb7dd69eba79bcef5d838f

SHA256
879d3ddbad7affbed3290ffeaf488d3badc6bb19637a7381d0ffcbad263f5e10

SHA512
fa4b18d784bdd7ed05271274c83c2cf9e7299187dc70d4384f7b0c23abaa7117f27f6bd4a2d729b9c53dd851d7f1573356ab8ec9e249cc17babb85c24f2ef15c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
78KB

MD5
6750dabc137e90140cdfdb7cfca68c9c

SHA1
f01332b33b43ffdffd5aeb55bdc347082a0475a6

SHA256
a50f08f9abf468fa0f649bf7d109df0585c598a7491d0f73e471dbc64add15f5

SHA512
25e70420531990f73efb4a8a2d2092da8cd23e969d3f1aca304a16e8ba33c6a7033c6f6f0a6ea5d90ff109b7d8e8e112d3a662fd7c4de9e785ca26df585b0e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
184KB

MD5
990324ce59f0281c7b36fb9889e8887f

SHA1
35abc926cbea649385d104b1fd2963055454bf27

SHA256
67bcedd3040fc55d968bbe21df05c02b731181541aff4ae72b9205300a4a3ecc

SHA512
31e83da1ac217d25be6e7f35a041881b926f731fff69db6f144e4fe99b696a31f9ab7766ca22cf5a482743c2a2d00a699ca2c2d67837a86c471a2dd3bed9ea1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b79b0dffd8fb0c9c84f609ae7428e457

SHA1
1639c7ba7c07a8ffeaa2d880cd7e4e2cfa5bc3ab

SHA256
88ce89f983fa0679938eb3b362185fc2e3d7cefd63ff5886568b0afa797513f1

SHA512
e7a3e52af75b651b49afdc1c4e3eb1170498ac7fd7d6b8473b94eb631999be251ed20c0db811382012030261e7532d7a39d09b533ee79ca221906e0aee45ac03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
396d755aca98a731e9a468eaf30b6ec6

SHA1
ced4b933011cd854db855e7417a13478b595a84d

SHA256
aa116803a63fbb75311a3533515b14d8c28c05e5f62e190db208e54170f0b2a0

SHA512
9a4cc667e46ae301d1fe7f88a22c421133f45dda706b03d0fea5107fe76e118984b1f1e655aa52da1a2c654f43167807d329ccb4ff7b88bec51859f09e1b871a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
935e386a0fb97645de67c5905a534683

SHA1
0620b8ef38cddd16e6750247c8ed0c0a887159b9

SHA256
381cc52b05a7afab6230df5a92a2693e451bae8b7684edfea9ca6d635357f49b

SHA512
98ed881c47321239ba50799328746965bcfc90a78798eebd62d2bb91964bf8c733e2f993a1abc238afadc2c59e7a6caf8a2844979bef84842eb4c2a442444f2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5dde9af11eabbc60836378f5fa235276

SHA1
3552f4ba6f6c67713f7ca2458ccb8511bcdb9187

SHA256
b3055ce3304dbc48d1ccb354de04f72f89c769d5d93c94498a6cf01d4ca4d986

SHA512
624c5d5e5082e9e6e096701dddca8753c6a44aba38406797cda19bb7ea80337e276e17ed2b5933ae54c9f04decb0caabbde2261403647625cd606d61cdd6cb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2b8e616ae66e1debe7a9adacc124154

SHA1
7b524d1a92895f9e231ba675c318d6457ef0bcb3

SHA256
0befac8117c4436e2ffcfeafaa99d93fce9eebf774a8883b3c22cd202bb99c2e

SHA512
fbaf41cf38d5159a4def33fdacdd39a9f569cb66bde00b5f6700650b005952bc08c7264b09b0d9b21ce260c523ac079edf7f4a351488cd715dbbb55f01e58664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9ab51668760fe8fcc6127755009f1bdc

SHA1
fe5fd8b1c568b2a565eeaf729208c2c387736128

SHA256
4eacfd1c0424ee631ca39e236c997116d58e52dd6932345797f9a29fdf6a6fc9

SHA512
4d567995e34cfdff5fd1e23cb837688d3660fc5a1ddfb1f8d9f1a6352d92788e72695f72876424e383fc1e2f3878662cfdb2e9e5d596efeb48ff163b9a31dae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
6f614fa2cecf3ac00d314917fe8b0f45

SHA1
fee8f84957ccf04711e8b907eef22e399a163f34

SHA256
23a831d8abc5ef5c941ae87f9d54f61292c3a4802791a96c99d79082b43e5089

SHA512
7f5b8c08189b29b397a5d4b020fe951316c942bf83e44524e48177c03ba4c2230071992be917bbede406e919d93267f1b758aed9c170c00bfe4fabfa562241c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
83f54b9ff28bbdac23db63d52a48f11c

SHA1
cbb9eabf58193e74f865d5ec7d266ecee0e25554

SHA256
8d9fe0ab359f4ea813c7cddba5dbe0a83b4b110ca1f0f62999b8324113c26385

SHA512
c5266f162524c1b524101ac970ecbffd868adcafc1afbf2e698ec87a40dd0afb295c1a0e992da875ec302ba5f43cefe6e04dc5b660aad6a607cc57e329a5d780

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
eebb87276d4d8c8e86399953f1fd5d76

SHA1
2c1b7f15617dad6c5621c1a4dcd4f9e85b50c969

SHA256
67b90d14705ba0d32de1a712d96cee5ff1ba058c11206bc892e11ae77f985bc8

SHA512
9e48898e2dab7bf7b0b23242a2379d04bd717a76c8d2362b413cbae2d29ef2e50ae9cc5c4521a6092e53e12e64a2576bb13afff815574204e722d48cf041dccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
23b13c8a5859da2e300f04fd8eeb81a0

SHA1
c38ada0e3966fa2a4d16a43c40ea1df43f0769a6

SHA256
c5c000a59a8a61c03a3deb490fbfc5b633ead3831c78691d77ef9097ab2d30ac

SHA512
f548f415713d4932faafb23cb169a6d348ae88614b6df1cfa08053c2f16f1ff84be42b5709016f7d3fdafce920b692ee75a577d28238fcf68c2ab47880cba654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589fd5.TMP

Filesize
48B

MD5
7a30ca59105c6225e734692001401d5f

SHA1
c6dbe502af11765c70c24a9bd6bfdcdbec3e4720

SHA256
f8ee98d80a068e10e77c40e46c8eee51a103555f8d1c22fdd32bd1f8b2f00732

SHA512
844a90e4326a4587b2d4428e83ef2032e3f4a72ffe1f2de7377f56f1eb580a1358262ef6caf0dcf05f1368df3559a055101983d8a81b5279e6cf7d1938aac906

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
56c2b7ad4159b3f3309ceb1922e59596

SHA1
3a1b081330ad13fab3c14564c2a19fa5732439f3

SHA256
4281f63da7aeee2907b2881dcdab9d179f6eefd564821cd51fb02d9764e932ab

SHA512
7599918120d131ee5c1254149299a1a1dc4e8ccb614de21c396affe694759e49bc2c03e0e9d82cda97de11da4899e8fe24f84294eeab144af93960530adf6df9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3ebe3ebe247b83786b2a572196e5aaea

SHA1
1d9c175afdd25bc1e5d6d41b0b3fb5b4fd61cafb

SHA256
f8cbcc5710ca57d2deefc64f0e551d71d1d7dfa80018a3da1b329e118f362c17

SHA512
69dbce9e3afa3c3ba334db0f948e86c8f0c13dd32cc2416ad8994beaf068ea5a78b34de973e4a727e4d6fcc0a6959ec1d5a06b0ff83548b4b7d1ae492ded0e61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7091f287f3afd315add08965bd325550

SHA1
d11b239ca6e496a7ce4fcadb333ac12f0a2ca787

SHA256
bbd94ef9c98ecd502300e2bd6765e0fdc1407afc158b5680b0e3b5b7c6e30a23

SHA512
1b44d663b679975557ad422d5b96a66c80f26b1829b85a3055e886a53ef4520a11f07954e5cc25a5ce0959d5abbdc89a547f1ccc3de0ba4ebc90a4f855c1256c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
52c201e93d71ad4e076ab2f422d61519

SHA1
dfb9dbc23a82a895bb59deb5435ca28e828da108

SHA256
30f8b4e15bb6f98fadc4258ad7de2c9811ccfac571ae18b6d5d3539cdf94b88f

SHA512
c42aa2285453e4d76648d84a0c71113b20543ed742ef2f6e12135774c95bbecfaf9f409305abea5bd749ff60d1860c911c6026746ef0e7843cde57fc461dceb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583a45.TMP

Filesize
2KB

MD5
cea1528f3054e4907a43204eb8f0ef37

SHA1
dac8298a8656ca6f1fa78f36088e2844f4434979

SHA256
70c9b72e16f1d31f6f57b9a45ecc64534989f902d6ebea83164bebfdd7329fcc

SHA512
c4bbd03927fdef4547820746b1e55c07032de79fe58accba15aac27f75d208a2f169befdb08ac8aa3bf00cf8c75f85425cdd3c99dafa2054636c62ca445ee208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2a1dbbfeef205f6edeaf29a3fdffcc78

SHA1
10eccffa56ad87bfb8cda60a6a49da55362cc73d

SHA256
def42df8d152e6b49db927f304b805a5910436bd7758d793d933758e4d64f1cc

SHA512
6a388c4ff68146fe7b58f5b673ff601c9a93c1a690c97098b840dcde01f870a029d4ce0bc44fe5de86cd7921f5afe048cc96426bf2f4a3dc26f16d943e872a9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
11f40f4761cff7a82a5cf22431ed7230

SHA1
d93ce898b9d5a9ee80f68949052381f12c5f3c7f

SHA256
224a56d8bd02cd6c1578a76754f90523bbf8b86bebb4159a07c6c8ba922e76dc

SHA512
97cca3667a30097481baf1b078f95c88fe8577e680789cd27a1be07ab46508e6c3b43791df5e75ac5b18722033880a56cdd95591f91bdc4f45fedc249d9241b9

Download Submit
C:\Users\Admin\Downloads\FINAL AMENITIES GROUND & FIRST FLOOR.zip

Filesize
15.2MB

MD5
f1910311fd3459652560238f51a86b38

SHA1
4b9c7332fd56652301a71a7963cba0a92ebf09ea

SHA256
bb2347961d2cdc28926ac4b06b01c6a7e24dea143972ee47d2e092658a060620

SHA512
21d770906088466947800bcfdf55bdcae042361d5b42193eb52e71a2312ec68676f9765c91ff8a6c914611d0ce8677d4af40113bcbfd5d2ce6edf39b800887db

Download Submit