hxxps://links[.]wetransfer[.]com/u/click?_t=af1237700150406eb4c2f92dc547d2b0&_m=f03a7ee9504344caa7c421b4a69e8a0f&_e=LcuzABROTLv38kiHMpfBhxsMy-lRIMXbqG6YLeAP2liD1770hWDF-56mRKNrfOgzb0zS4FRcxxt1S_TE9EYQnRJJlglF5sV0H2i7wjw_fPbjTF-rvgJiadGbiCwZpiQ0Kv67IwSuZxlzT0uvQmoSJ9UWOfiamxwyjLWDz69F_V9MCILdawOt0-jKIu15eHPbz7dNO4UovPldpvUApbW8AyfZhXLMnWEj41sZM70ZP33UZuhGNfVusBDWSS3vGnfk9G2zUcpHzSoBK4aTivuq1MR0BNsWy2hTwLJiiKJHLeViN_fn_l5TFiXWI2e_rhmnLanC8nf_kOLSuURHaIUzOhaUjdw7iAYJYHCTPMiTWuG_EVbIy_BXqzH_vgAby7i8KWeO1-S2lzvNNQcW-Y7D8wRmuUYXp5FidxmYq3hXHUU%3D

Resubmissions

11/03/2024, 05:07

240311-fr9z5ach7y 1

11/03/2024, 05:05

240311-fq9yqsch51 1

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://links.wetransfer.com/u/click?_t=af1237700150406eb4c2f92dc547d2b0&_m=f03a7ee9504344caa7c421b4a69e8a0f&_e=LcuzABROTLv38kiHMpfBhxsMy-lRIMXbqG6YLeAP2liD1770hWDF-56mRKNrfOgzb0zS4FRcxxt1S_TE9EYQnRJJlglF5sV0H2i7wjw_fPbjTF-rvgJiadGbiCwZpiQ0Kv67IwSuZxlzT0uvQmoSJ9UWOfiamxwyjLWDz69F_V9MCILdawOt0-jKIu15eHPbz7dNO4UovPldpvUApbW8AyfZhXLMnWEj41sZM70ZP33UZuhGNfVusBDWSS3vGnfk9G2zUcpHzSoBK4aTivuq1MR0BNsWy2hTwLJiiKJHLeViN_fn_l5TFiXWI2e_rhmnLanC8nf_kOLSuURHaIUzOhaUjdw7iAYJYHCTPMiTWuG_EVbIy_BXqzH_vgAby7i8KWeO1-S2lzvNNQcW-Y7D8wRmuUYXp5FidxmYq3hXHUU%3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
2688	msedge.exe
2688	msedge.exe
212	identity_helper.exe
212	identity_helper.exe
5456	msedge.exe
5456	msedge.exe
5456	msedge.exe
5456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4864	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4864	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 220	2688	msedge.exe	89
PID 2688 wrote to memory of 220	2688	msedge.exe	89
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4904	2688	msedge.exe	90
PID 2688 wrote to memory of 4572	2688	msedge.exe	91
PID 2688 wrote to memory of 4572	2688	msedge.exe	91
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92
PID 2688 wrote to memory of 5052	2688	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://links.wetransfer.com/u/click?_t=af1237700150406eb4c2f92dc547d2b0&_m=f03a7ee9504344caa7c421b4a69e8a0f&_e=LcuzABROTLv38kiHMpfBhxsMy-lRIMXbqG6YLeAP2liD1770hWDF-56mRKNrfOgzb0zS4FRcxxt1S_TE9EYQnRJJlglF5sV0H2i7wjw_fPbjTF-rvgJiadGbiCwZpiQ0Kv67IwSuZxlzT0uvQmoSJ9UWOfiamxwyjLWDz69F_V9MCILdawOt0-jKIu15eHPbz7dNO4UovPldpvUApbW8AyfZhXLMnWEj41sZM70ZP33UZuhGNfVusBDWSS3vGnfk9G2zUcpHzSoBK4aTivuq1MR0BNsWy2hTwLJiiKJHLeViN_fn_l5TFiXWI2e_rhmnLanC8nf_kOLSuURHaIUzOhaUjdw7iAYJYHCTPMiTWuG_EVbIy_BXqzH_vgAby7i8KWeO1-S2lzvNNQcW-Y7D8wRmuUYXp5FidxmYq3hXHUU%3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ff8f44846f8,0x7ff8f4484708,0x7ff8f4484718
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2144373564388733093,13662104117487909038,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1828

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x418 0x3f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
1024KB

MD5
7ec2410a5566f9ef99b8371f55119c3e

SHA1
e33af80871db901edd38eb5378653024fbfa699a

SHA256
9ca3ecad83e2db5f9ecf77a307b88e8ed822722a48a414fa8ebe9ba9cb2168d6

SHA512
80ec4ba4c0fd114fb09c427a12d30c1f870bfd5ee8c4783111880b1339efb693353a9be478a49713f58a3292e53f5b5faecc962c1c4440fff32668c3e149956a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
512KB

MD5
b075b9b3f2cc29990bf9634f49558186

SHA1
12c18a7c4c1eb625791de871e73b90cacd42a70e

SHA256
6b38d0bcdaa39d786817b4499dd6320a8dd8a2a72de5ca0b75da4af24cd37a40

SHA512
559f697fe1bfe43c4d46e3610ba48ef13686a2a8a125066c90a6709a6673f74d30b3eec6c4f3648771978518b8760845ae1df582c729809899e95d2c350ae6a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
70f2e9193c4debe275cb260d785dee75

SHA1
5c17f960e160090acefe2fcff121ad581b8aa98c

SHA256
c777478e1a03cb49fa6dc6b2ad88624b951d83f024d3dab2e93f2c5a54cd0a88

SHA512
d70bf1b60bca95ef5051e86b504c9a19fd4bdb7b369957a8ab3d13d03290aca82552f82d0342d500951f18b4512207f4365ced1e13a5f2f3c71e464a349c0e0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
45a33059a7b16b2780bf9828693806f1

SHA1
b130c8bf20c499d777e8a0a054b96e2694c09fed

SHA256
e479b684a7fb138f2c976e035456dac469039fb6fed9db9a5e5eea3eab93faa5

SHA512
1f5e609100273002a873bc9eb3ccf5af0e5fb3014537cebfef9cf21d2502f20755305dc6d32b4a5809848cf231daed105c7477f6eb1bc986777f48a3777a298b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
23e780b94c184eb20383def9fd78f941

SHA1
9f3f941531041e7934752ddc195d421f41ade2fc

SHA256
b2e1c9a579160c0c66cf1fc12585a673fdc816e22e14d5fb9a18a71bb4663fe5

SHA512
0ed14fae1b10a2dc5a453c6827be3622cacbe9cb3e4c06157102deda540d611236b2b9ece84df089dc44f9e5176fc24ea93c38f1ad67751b3c8b65876f39eb92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_backgrounds.wetransfer.net_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
aaf815e7624242dbc66b28050c7c2510

SHA1
812fbbf9bff3fe59adc16f2bb0bad75a0f5dceec

SHA256
2fca621def33c977ac20de1cf0a0b0a15708b1c0cf5779e516cfa1223aa8c386

SHA512
857e633a51768578e03ae485e34f0d0bdd39908592f9d4a878281e2acfea6998be7c19c850617a996b53d7542cf11a9c9803bde682aed609b3ab49926c7f599e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
76d5a073eb3c431efa45fa0af457d7e3

SHA1
bf39ce94b4c47996b62832eb73ab18e57826a803

SHA256
e81cd5140b78707b2aafc1806375931dd75f3d666280884804c7710f9d87b8d9

SHA512
6bfb39f8fc87f47f82d11a3aef5eb18c6f0ebdc5493defc2b80c7e66b16bd951255922fcf3cdb88ebc14933e10d69b15ae16bd260dc26a54fd478d9724961c2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02782020c9fbe97529a66f15012ac965

SHA1
895cf7f0571b9f7bf56e57fcff57282d3a8b7984

SHA256
1e129d6d52d8ff85983b8ecdb6bdaa403e3a15b7947aea9a509c797bddec3c99

SHA512
dc25b6ed135d7185afc9a5fa6bba6c782bc480308d90d1f5f33a27319675cb80e11b59dd0f41c591572aec8a47a8541e7eebcc562e239fadfb9f4d2808a7268e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d02807a218f00882da541cf40066c13a

SHA1
756a72f3221c28b329dc35f7097b29926deba216

SHA256
f35cb912e958a06e22e13f1564f2d73f0edf3d9f7a6b011c8a77a2d1b132cc00

SHA512
986dc3ff4dab9edc286de2df331dadebd6a8e6d61be055a99d5f8986dc8620198ab788cf97a3f6c67b7287c1b40f03bc535105575c00066df8608d0d815ac1b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c1fb4872e9bcbeb62e208890f5e16f85

SHA1
29758bd008e7748af799318b6cab55542e9f1bed

SHA256
5de340cb64a336fb13f6ada8912371157a40f00bcf264fbb1076bafe2fbd87e7

SHA512
2e82834b348eb104940056f865fa6eaf3f3cf0fcdc8cfaeea5cfb2046e46d22e99a8ca7064a2ca98901be16e0d9fa0f15047249b655426c350e5b1eae3f757c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
3d31afd0fa60ea2d37da328364f6a359

SHA1
ab3bfc0c060a0e7631c48816e39fd8be8b14924d

SHA256
e6e62e28d309046c0f43b513394c866661e917b12d5f63d4fe45bc868d628822

SHA512
737efbf98587ccec9734da72ee4f73c8c691d38964bd6152742ec571405c4df94ef1babe7ceb7ef5321106b745b75191d57c6735dcb930966b3dfd8b6ab58f71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7cd47eb24c9c70637d400e91e747463b

SHA1
b8c7592c95a825c3f7a79816cab2999f19f4057b

SHA256
bd98d2e52034b04964c5de593626282c573cb8655cea09875785997c834c6ae9

SHA512
0db12b820861c53f146c232da6ba3e2c5ee3d1693d5d5c836998241f25dfe6b0abccb963f8850eaa9424c99b46c995615548cbebc502cbd6f0f0b9ff6526d0c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b76636d360f602a79bdd7f16feff4bc9

SHA1
908aacf345d76596d2d51fd70e0dc3e318a12e41

SHA256
2bffff57536dbd2b7951d64ddc27ee40607f25a97fd47eb6c70eb133480a4000

SHA512
6909e8075a13248ce0e73fb85e5e83a1abbeaafc888cdfc6817c2348728401c5e1c9bb3d3c05c62ed76a72b672069ffef835f7bd5332c04767c2b84bee8607f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9fa6b7cf59b258f44e389483f423246c

SHA1
8c5465189f11f90bd7a52e162e124b0f4b766077

SHA256
11a718b09ea4e27b4d09c20816971e2a3fecd1682f99692e7c50caf5e22e4527

SHA512
4225f9aadc507bef3cb240cb267a66dc2ba0acb7aa0cfa02cbe9a990eb72e8ceaecf0d815760032906eb91fbcc4ac1bf9ec25728c09699b7340653351145090d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b2647ba3fe6f4eacefb4bdf5e274be38

SHA1
dcea958b5596b4739d77949d94711074c1e0efcf

SHA256
badbae56459f665a31aae8152fd1948c308ebd59caae6b958cda565b69a8c832

SHA512
2c2c382df5b1a5fe78a60a82759286cf9f9e26c58f0eff4c26c328e0965dae593ca54fe57097327a42eb2834136e2c85099166537a5e3f10038a0c6ab0d4acc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6b36d0d6502266c381e0a08b101c25bc

SHA1
0f279705ae7532cad0ef45b756b9ce12a347cbde

SHA256
af01c574b88ccc534e5798c61b29fb3ca920768d1989e90145d7f8cf7328b24d

SHA512
bdc140e1fe94c180a139acb25be0f88d031afb4855d8b0133bb9c00e055eb11a3e0863586eaa767c2eb88439955b1642724a89b06b5cc19f63f37c665599e524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5798d5.TMP

Filesize
2KB

MD5
0f92d754b460926733d029bb30455f3f

SHA1
418484a7655ee890ae015e6e6014d0bdcb8c7724

SHA256
a53dec474385355e6edcd03d80a73eb00f363c5631c11ef0f4de3b1a2a446f0d

SHA512
6c11ec581e6c4cdd41fc49eaaf19ed27c3996293849c4ea513e46217cda73994a137398d8b38f716c630051191b1164c5e5ab0db81f77ac0a894c3fcf500c20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ad62b9f12d422747e430880135afd829

SHA1
47e41cf885b60cf9f5d99a28cdd7013c8cfe7759

SHA256
8e6ea75fddbb4f6a1d09372d52ababc39c399427c45865da78ddb9912dd3e0cb

SHA512
99e68c752613e5144184b4a63bac0b7aae699bd67c01a7ace106c4e83d2098dbb1ceab351d8ba1dd48136df69f8b483c53c84376ee8ecc39e3528bc0430eaef3

Download Submit