hxxp://steeloatsre[.]top

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2023, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://steeloatsre.top

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
1244	msedge.exe
1244	msedge.exe
1608	identity_helper.exe
1608	identity_helper.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe
1244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 3604	1244	msedge.exe	31
PID 1244 wrote to memory of 3604	1244	msedge.exe	31
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 1368	1244	msedge.exe	87
PID 1244 wrote to memory of 3848	1244	msedge.exe	86
PID 1244 wrote to memory of 3848	1244	msedge.exe	86
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88
PID 1244 wrote to memory of 1936	1244	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://steeloatsre.top
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffecc2346f8,0x7ffecc234708,0x7ffecc234718
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1344 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,6325561431580430109,13565908260771176536,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0477e8d5f2ca61e6037746d359e0e27

SHA1
025ecbf1ee3429c252baca04b648b0b1c343d5b6

SHA256
5247adecb13d0664e188ba65524419d0b4960e948b267bd1a059e71218b49d5a

SHA512
f04dd3db67545bd46ea597d514272df57d6040ec8a3d391d2bfed09d5a1ab96943fa5013f850ea5c3b56617a0a12949ea75ecac892fd167a329ee8fe01189c5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
92acfc3a2114929572bf8f9b6951e864

SHA1
b7e2d318ee7f423efe5fb1b41e480a5f996564e2

SHA256
e4533ae466753a15ebc5971abf3461362e231254f845bbe11ed9c222619083cb

SHA512
6f9556fec5a3f0ccc94e6704409ed6fc48f2e3eb9b1c1de870fe161c22a2f388e1fdafe3a038baa3a023b0de74e6ae99834f15bfe17824869474ea28c8db95ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
273B

MD5
a9362de6fa6df952745265852a1669af

SHA1
8408cf1d25d51b12cce6ac7ebd7d93d312b830fc

SHA256
1ace784fb05888acb86fe23435e4a80c31b9bb9c8cb0779265ecca906a663156

SHA512
ed53fa564b96761cde7dfa8e5be9a595ca47f96637d7a3d6e5af2b6db8337fa290e70d07ea9d829319057e38a1b00120c0c8dd7ed22856a02ddf8dd7da50c4b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
53eb45c0b060cfcc0472b1f392c20255

SHA1
9a99da2ee0d68ec42b0dbe531eec55d475a89017

SHA256
219bdf50406f1285ff0a46357812ba3295d3610ff2fe06a84e8909c6c45494f1

SHA512
37997c2f4ab95bde7528a1890201a9fc2ff118d6c7214ec0de97e1f8e6299952db45fb6fbf5c857e463a4b4764d4f30f451d81d8b90c889fbe3e4607bcf0ca1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
467553e510b2bc91829dcebf31e6060c

SHA1
87a90b39921b3c6e392b9c2352e0684f552265fc

SHA256
b545093f4d140abfaad46a35a8ca57b7c4ec995a9c38ec520d6d33ae94055548

SHA512
03c0eea88f9bc6286a711ffe6377369721c42131a3c23093e4ad493e5e6e14423d4e72c4d81ea3c3157cc195a00086b01a68240e53a9114015bd88e7dc0bc611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
81739b0389fd3f961f20477364834d51

SHA1
e921486d00690d6c1e703af78b910857d33cd2f2

SHA256
b938c767b26ef29b94e5fb5cbf18b9d4e3da5cf7d9805bef6fa2e71289475d8b

SHA512
151d215cb09e6df0a8134b15feae881d651734807d0a5abe0fa453af328d39771e716f1b87a27a55d4e5a559f1f5c9b97d4441e4d1091246781db17af04b7017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2dcb386b60e5422610e1f3898488a4d

SHA1
ee77f60eeeb79e80075b6c02a6bc1c2debafbb71

SHA256
566868dd94e3e297f3ce2ac48f7e4e7dc3145b0a07f1676669bd2a21ad71ca93

SHA512
2bf4ff5a4bc7c31ce26b5076c5d6dfaafe118cedfaa128a44ee035448b15d6c6e6a475152e5e8468b4dbee4f9771dee35dababdaf4216b5a6e13744ca4904b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d16b7adcba141e56b44e683885a9c683

SHA1
6cb88548be88ce9bd79b7b08713a3720c5916b1f

SHA256
87afc455f23283d030c71c446c35ac377db87c862361439b7e38cfbaefdbad15

SHA512
dd935928a75915ef73798dc54dd5eb8b5ba9dfce95566f0117532d56f0b6adfe2942c8742bcc69eaf8eca961b6e78a7aa2f35c2bb8589d5ceaffa7f05764a354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
78ddf646b677edfdc3743730d0ae969b

SHA1
2834692ca105a5387afcafc2179d8e1021909ae2

SHA256
0b0187771ab2a3ca3d3d74fdc473d3baa8844d2da2ec6961ea9014f43896b99b

SHA512
2f67041538953615c6804c362dbad816089d1a5ed603478d491e52029f7678aa5b1a1fceb913445ececc98886a54a1491d0a0fd8f5cc695601dcc48d05a16206

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
115d2626adb04908827929bca4ff9ab0

SHA1
029e19aa5cd5a6ac6d7aa03124d7bbe9024fd11d

SHA256
fc1e940adbf7b1d76d48ac2233ccdfd7520e884dd95efb9edf2b1f09c023d5d6

SHA512
ed4b3a1a8acedb24e3f24bfec41fea2418aeff2e5c6f4f899e1c60227b9b3ee248e1c516dc298759b3a27494b7a4c8c807d15edda0d0bb61c894dccb07cdae8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e1bba57794b6d12be4ad9d0348ad6d2b

SHA1
04865da29df5e68ea3b0c814a9d0af9d92a69e3c

SHA256
9965c966aa60276c873c238372d7cd48d7872e7eacb5fe9801e9cedf29eed87c

SHA512
2ff2a5f96c32238f497ac5f4afe6f3d6c5d7f984d2e6ce7bf9a733d18790e40ba2686bef1e2a7cd34a58dd5798e5a855a93a137eb388fa518690fea710786dc3

Download Submit