09948666f67dc8ee00b63b5e1ec17e3a0155ac7c7b555b8c662dd977a0f033f9

Analysis

max time kernel
78s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-10-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

the-long-drive.html
Size

55KB
MD5

bebf96343ffcca3a95cdf26c3198403b
SHA1

1903a1696b3faf12774bceac00765933168fbb58
SHA256

09948666f67dc8ee00b63b5e1ec17e3a0155ac7c7b555b8c662dd977a0f033f9
SHA512

e2a829f2cd05e2610f1f46e8c5e3fa9fc4ee79ac54ac18a5718a2ff7496dce13188cba40c8e360dcfec9391255c5e2b1ba459f3d1a6862c5f3c24942c869a32b
SSDEEP

1536:A/6zRapmHkwSHCXeno7z8X+NoFUeIMii2ov7k4x:A/6zw0H5CU3gJzk4x

Score

8^/10

steam discovery phishing

Malware Config

Signatures

Downloads MZ/PE file
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

39 discord.com
42 discord.com
Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

flow	ioc
39	discord.com
42	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

4732 msedge.exe
4732 msedge.exe
3984 msedge.exe
3984 msedge.exe
4612 identity_helper.exe
4612 identity_helper.exe

pid	process
4732	msedge.exe
4732	msedge.exe
3984	msedge.exe
3984	msedge.exe
4612	identity_helper.exe
4612	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exe

pid	process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 5908 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 5908 AUDIODG.EXE

description	pid	process
Token: 33	5908	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5908	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 31 IoCs

Processes:

msedge.exe

pid	process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3984 wrote to memory of 4876	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4876	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4028	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4732	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 4732	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe
PID 3984 wrote to memory of 2200	3984	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\the-long-drive.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bcd146f8,0x7ff8bcd14708,0x7ff8bcd14718
2⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
2⤵
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
2⤵
PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
2⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
2⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
2⤵
PID:660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
2⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
2⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 /prefetch:8
2⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
2⤵
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
2⤵
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6804 /prefetch:8
2⤵
PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
2⤵
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1924 /prefetch:1
2⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7800 /prefetch:1
2⤵
PID:5480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8056 /prefetch:1
2⤵
PID:5596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7792 /prefetch:1
2⤵
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8040 /prefetch:1
2⤵
PID:5544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13246545085357726788,7379794338927459676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:1
2⤵
PID:5540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c 0x514
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
c90ef28479f5e515b5fa6e79dbe951f3

SHA1
99928797c66bf872300a4b45a0b920997a7edb3b

SHA256
a7c41597dd081e7096e92b1649ef51c04422ad006009fc1a09b6aef6a4d55a85

SHA512
8bc34e08d2bf29644ce032df9bdddb255129d132b5a10f354007336bc2ee82053bf270115b775ced3811040c167ebc1846d5a747bd6b11777997a24bf2f17394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\304c8377-e5bd-40c2-ae46-29bba0653162.tmp

Filesize
4KB

MD5
eef562ceda8058789110dcec4143b2b1

SHA1
e1af72b80c5a2bb990547627190b469eaa215c79

SHA256
96af704a4474867a1a3e3978cd50d1bdd772eed7342b8e60a7c562685992af26

SHA512
d0b7d1667b000015cfaf47589f206a3349ed0c053536c4dc589a4de108f9ab456cba37a0dc33036128e2f18ea80c43736b37a9a5fa5414e0f121a09e53858284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000073

Filesize
53KB

MD5
c8dac58e86b93c9ea7cd4789d3720ad7

SHA1
30d42ac37cbaeaf97e097a932ac46f7efa1f4fbc

SHA256
1fe89201bed2a1f00a1e3d8de0eb43e7651d3b51469c40638329280c5090e62a

SHA512
de33c249dc3f408c84ee43d90f92d862da19351458e847bbf4f0370dd74d298dfe11cca8f148c69ff90c0cfcf53f7c0142f700b3b896160d93da09e8269be237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a1

Filesize
34KB

MD5
ad143e0bfd7a82b4c20deadd027471d6

SHA1
9b93f5ce2ade7b4c2b4d750b3e1811223a601cd2

SHA256
48716bbe357465a241d182a335c8a8210c3d987050df3e4494dddf88db6ab305

SHA512
08ea9043d2b155f452350979dccb6a618e789ed7fbf96b37215e19253b7ab04dda0e4b74dd56f22bfba58da2d31c184bdb3422eb8302be4b9990d20c9295253a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ce

Filesize
63KB

MD5
a5cc79fbd666432c461daec09604f082

SHA1
9a3df93d85aca657c5c8b60f9b4063128319647e

SHA256
9a7f91177674363a59d898f41192d993f0dab2ce2c93a180b6d1042ea4b9e279

SHA512
f93ebbb16738cae18477a0bd833098abee3a77880b8623ae2a462ee8e209487045121700e013dd0da1c7c3f5c9f24a56f02a5cba837df4ac1f33c9f6e3522c62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000d4

Filesize
20KB

MD5
4bb71581a47e597283a0da0f6bef0eaf

SHA1
536ece5dad210a9ad160eb1243f836ab18482410

SHA256
045771bfcf6c64cb008723fac614aee762de1c3b0f8f2e9895a37c788cd33966

SHA512
e481ebc6878a88a0cadc0123e5fc56ebfd549cfd76df69ef6d976c9015605b7d75092321f7f49d8c61cf611f3f9a39c96bfee995b7f9be3461f44e5379b79d19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1d43aeb59be8f0c2b4854034470e47b

SHA1
d1f85f76cda2c000a7edff9750d4ab4014f8c3bf

SHA256
fdd24499d4dacca66a67e0d8294dbe6da4d92aad62f81ba4b7a1983ff46ec784

SHA512
dc1cb47423a716f6e15c210f97621d0d6e9a0d540a7e2b7e7bbbbf540269971a366547be3c128ab378db7debe2d298840468a998a1ac6952ec3ab31e19f1562f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe00366f45156ff2452b6e93bcbd53ae

SHA1
0e749b8c9749d178e682de8f1fb09a18e21a1dbe

SHA256
5025d5c977b622ed5ab0ab24e195e2ca02b24d42f510b9ac154f10d921b66e07

SHA512
eb40b45ea2032adef1dc67c1dd07796062f1ccfcb96792720d7d29b96b3ccc7d2438d1ab7f4012b4d0afadd85f9def7e3a619979756724ab9450a42c12961048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cedade605a6e7ca3bb7a6b51517ac0c

SHA1
9e669bb54f0f6f4782206d27ac80e6525aee958a

SHA256
df68f0c68cf893bfc275146e84dec42391b5cb6fecfed34537589ab92f7fe202

SHA512
f31125771c68576b20a7f89370b2490d2c6ecf4a7c782be5e3f2488e04c88619f55d0c6cd0e24ac013ceb27aa0c0b8238cac8d1b6028de6c6130187888645c4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
411759eb671d215756cd4ead3a270583

SHA1
7cb192fab94c668de2c4c5cbfed937232cfbec88

SHA256
beee1e06d9a92e92e2895fa1bfe5647970d30d0cc14ea0ba68d32d1914351307

SHA512
7c686cde083bd70cf75ee9269540c5f4ebf57acdef7042bfe5d1ba226615d0ab11665b5b05ba54710ef251ec071b402342672f23074337117a4e9869f63799e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
146dec1ffa05d2e1821f14c6a0513277

SHA1
6e5dae38d2dd43009aaf2c96c1fc2db3bbdcd0b3

SHA256
b216a97c4ebafa81a6fdedeb0c7929a927301f9937cb29312e08be3a011900b5

SHA512
c8884d0d1d6b8b85fe64e888d3dc32f41c400736c663eaf44d2b258afc405dc82c73f5189c47b37bc9652ac058ecbefb4fbf67bac47d0bb2eb51c0ef95195191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2114ae4b77b3fc3bd6ea244447bb4f27

SHA1
8aeb634b22ad5e981de8f7be08652d6cd888bf7e

SHA256
2573eb3e8cb76f6cead4dce7c491b21221593a078f758602b54f42da872499ec

SHA512
b7ab8474017619aa3e3094b41ae4e387ce6f65427d914e321c09dad86605da6f181bf14a0f96739b35a75e42337b38febcce316d3bffede983ab2567703afc33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
aff720e6da20dd36894b5e77fc191071

SHA1
cd8efeda8612e72680d062a47dad56be4e218a93

SHA256
ef6937c0e2ef7dfdf88674532a71d81a2574f0aef47678c7af9d58dd46031493

SHA512
bc040b67f996a3bceeaba2c56f7425193958d0c028bfe9046811d1cd69a5618854b34c5c010686fc6040309423ad9deb9d8b7c9dfe90c691869d6e6216e68e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
f8c92e2004c82a43b8147bf73702966e

SHA1
f07be75360406aedcc2ecfeeb26a2b41f42fecae

SHA256
5323333fe463b4bc1b19093beea11e5d5d8f6d51cc9497136bc72a948eb2f086

SHA512
a6a89af489e47d02eb53b322d22a65fdcbe1f7dc316155b2a8ab82dc6e7132148c7e745521ae370d1d56472e2ccab9a365196e6a27c682ea4234119952028caa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580829.TMP

Filesize
370B

MD5
4cc78ead58e9995e0ff63c9eee26d355

SHA1
9c4362580f1dcaca892a35defabfe714520f9f29

SHA256
d22937279ad262fea59e8baf01e85989105d96da86113e28d145e6f0762024a8

SHA512
97f900c4251476da65d8a3ff8e6cec6f8c92d74f450688e4660baf0ef0eaebfe6f1cd7d9d4ce6aedac913d567d753ab50cef8c0d73b22b14c3a2b3e1547ab093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dcce09b8bb01b67a9b176685e95eb8f9

SHA1
b9a592473df0675274988a8096439f2bc0a1f2fe

SHA256
abdb1c3c8b4811f9848dfafe7b61c1d8c7571cf20acfed4b1184a8780506a8a5

SHA512
be8acd88f3564adefde272864f66d67c44116b83771896042d4cab43c858df899cc5be7445e639e421bfffce1f5d1918ec4509dbb2334e82c5355826b0fae456

Download Submit
\??\pipe\LOCAL\crashpad_3984_GJQRLGINCUXYAYRN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit