c9f2e2abb046ff2535537182edf9a9b748aa10a22e98a1d8c948d874f4ffb304

Analysis

max time kernel
1716s
max time network
1774s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2024, 07:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteamtoolsSetup.exe
Size 978KB
Sample241115-h5d6qa1blh
SHA256 c9f2e2abb046ff2535537182edf9a9b748aa10a22e98a1d8c948d874f4ffb304
MD5 bbf15e65d4e3c3580fc54adf1be95201
SHA1 79091be8f7f7a6e66669b6a38e494cf7a62b5117
SHA512 9bb261b4ed84af846e07ffb6352960687e59428fd497faa0a37d70b57a1a7430d48ac350fbb0c3f0f11e4231a98ebca4d6923deba0949fdd7a247a3c02737355
SSDEEP 24576:4Fa9OUi2VoN2gZ1M8UQag3BXrYZt+GgGTfG74T+TRcL:Z9OUiTN2gZ1MExEZkkf+4TARg
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

steam discovery phishing

Malware Config

Signatures

Downloads MZ/PE file
Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 536672.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
4200	msedge.exe
4200	msedge.exe
2844	identity_helper.exe
2844	identity_helper.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 5068	4200	msedge.exe	99
PID 4200 wrote to memory of 5068	4200	msedge.exe	99
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 4784	4200	msedge.exe	100
PID 4200 wrote to memory of 1260	4200	msedge.exe	101
PID 4200 wrote to memory of 1260	4200	msedge.exe	101
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102
PID 4200 wrote to memory of 1848	4200	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\SteamtoolsSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SteamtoolsSetup.exe"
1⤵
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff917bd46f8,0x7ff917bd4708,0x7ff917bd4718
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,17672992964998094657,10939681502502402443,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 4366bdb3ca7ad176f0d49c362829f70d05d86fab8203ad429ff14d6483d60755
MD5 cf507a464732b728b73fc1573b83fb88
SHA1 7282bc02c020bbd2bce73e14b2235271f1d3224b
SHA512 9b2f2ad5f5bd55afce4bec309e17a5ff361c8ab678fb85137a283dd99c3ec2e6a00cc19dbbdebd7c73bb0f45d922f7c97c40a78118a443404843918d5e806858
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 ce5a94e17cef56caabce41b48402961678a39f584452e8b8d357cdba18fe733d
MD5 c0b75bda2da60fb1141219b074a75b22
SHA1 5762b3922e8202c08689cc6ab8925292e1af9b9b
SHA512 23a81cb52917a3abdcf6ed614356d46ef953774be38ff3847a1f9e663d459d6bc5e9c20f0f6995c0cd129f22bbf32a8c21cc26f37ef9bc65b2d7d761de9d6fcd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 ad9f8a7636a22e5e5ff535e001f780fe315408639b7cab025b91933b043d658a
MD5 d3370109e806dbd0a6e424ee23567156
SHA1 43320a71242ea77996f68f13ebea131faf835bda
SHA512 448cc37a5807d6d64e5976e3eaac33f2fdd16cae7079491c3eaf283c85694c9faff4fcfc2ee6892c11bf1f1ccce213e6f150183efef42722de50db917acf7b93
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 e999f6cd6b3d4bbef80ec01ec648c0db4b16cec600623e6294904447c5c7f183
MD5 9b58836c0657c98d6098eac2235be9bc
SHA1 199d95f49d2ed088c3ac4f516fd822b1f9033b11
SHA512 79ec89b4815d75333e53782fe88cca8f29f97c30d2f0b3c50d5db541f1ec84acba663186b28ba6b3f560d421a75d56ddf3f84474cff6426cca49c0f1a3cc85e0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 807B
SHA256 d020364dc51250e9fea9b0966c53eb65e71a7cd6f5c6c9ddf7eb949436a08eef
MD5 bef4f6f878056ade706b22e49235d4a7
SHA1 b0f0cfebdf6d6b8ba5c29486ee122649d8633236
SHA512 21cd30e67683da00c68302ddd6dd3ae4d6db21cb09999c6246e52774ed8d4da031bf1a5683d0c67b31d740802e737ac16ebbd0e503f3d40fc9243445d50fdad7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b370301b5788627789da20691f5ac2fb6b1b4ab896ca478fc738cd7df5601dbb
MD5 30f82942beda488a3d8424b6d11247db
SHA1 3924114f58825a5b090624dcb1d58412a9e44f44
SHA512 9a1fbb0e8a1b2a95e1d9eda0b07b9aea1756c0ffd7196e248287b29e154971c4f105fe0247179061176b8097c1bbdef0d4f878cceec378e68d9ed832e8bd9678
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d3e2d9513a87afdfb9a7f07757ec768d8992cb982609d7dfd551f1f73519d784
MD5 e672c5f6681d0e078ec1d227eef7237b
SHA1 17ffbbcc5e9467a10d0b4ea44da82d76e989e402
SHA512 f220801f632f5809ce5a4a64b8758b06a4a31667b605397baf74fd2b35742a610358e1b81724d5f7e2df1997a501490a0d272b3ff2022589955d32b2809ec6fa
SSDEEP 96:n1kZo1QYeSwpvWMoiVmdeHBjs/UWQyV+VDCziEwb:n1keVVGWMXBSro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3f8d570cbb8e2f7b3a109eea89e7d6eb83fe7d6d79b828e6e1288f79f8159f8f
MD5 c252d4c38324f71abcf2e14ac3146491
SHA1 9f3e1108bb5ab4bc62a833580e056277d91f9d9f
SHA512 4d9ceb2b5dfe05ac60deac394b20afd49a3b809a95b6863c8d21ac1b91a0477d633c68f9c5fca1043a18ec7718b6a78fcb11d7b93d0e67dbfdf4e58634d132fa
SSDEEP 96:n1kso1Q8dSwpnmWMoiVmdefuX1jBj6/UWQyV+VD7AiEwb:n1kR9IQmWMPuXhB4rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fa4cad9df08b9cb94f4166e7424bce173580cdc796f0a341bd1fde6f94920b76
MD5 81cbaa4a60fe6f22053de24d5bf0e4fa
SHA1 38b27f6ced2bae5e6b05aedadaa3bbc6c916d032
SHA512 28bec22d0ce2bf0044ddc1d97cacc4df86d6b91d926e714a4786c9932229d575af8291beef9a6d2acb4a587c5d3c9afb4b445d4495aa5315f451f55d36c1f476
SSDEEP 96:n1k8sQqo1Q8ASwpnmWMoiVmdefuX1jBj6/UWQyV+VD7AiEwb:n1kE9vQmWMPuXhB4rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a5ea1aafc4e323b6cab1eb23e2fc75e1d8d3716121f5dc2d11ddf82ea559044c
MD5 291dff970e969571d6666590be4306cc
SHA1 12376e306d8f64b5b2935aedc436c482a58741f1
SHA512 340afafa99dddb3286b2a72d9a5d424705a27004f9bf6e19a90beae3189a701f4012bc483bcf950805db218c8692003389243a0f1d8cc4fc9244c021abed4bf9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGG2RUeSHhfHqRUx3GPOx9n:A9iIxuERzA83h09RZxYmt8ySFGmx8oEu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 59426fa3586937ef4d734b5a00ee7f89e5a1ebb872fee35463511d71ee67312e
MD5 a9f287ce8b4de7e6210f795d663a53ec
SHA1 82d7d70a39320e89eb92e3c66e3cdd7d0a4d158b
SHA512 fb8140978016720ee853eb3ec258fc5b97e15a0a9c29d00d7d8711890927fb0d7e74dd571298f7d5092e0630da3e1888e77c3fb60b33c48db82a8aa482f83a90
SSDEEP 192:JoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGG2RUeSHhoHqRUx3GPOx9n:19iIxuERzA83h09RZxYmt8jSFGmx8oEu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 536672.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 536672.crdownload
Size 2.3MB
SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
MD5 1b54b70beef8eb240db31718e8f7eb5d
SHA1 da5995070737ec655824c92622333c489eb6bce4
SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb
SSDEEP 49152:UDP/q9MIX/crfcNVBaXp1m0zyVCMwBHgFzoZhRP8:kC9MI8Hm0GCjgFc3Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download