hxxp://steamunlocked[.]com

Analysis

max time kernel
106s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://steamunlocked.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe
2740	msedge.exe
2740	msedge.exe
4564	identity_helper.exe
4564	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 4276	2740	msedge.exe	84
PID 2740 wrote to memory of 4276	2740	msedge.exe	84
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 4300	2740	msedge.exe	86
PID 2740 wrote to memory of 1548	2740	msedge.exe	87
PID 2740 wrote to memory of 1548	2740	msedge.exe	87
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88
PID 2740 wrote to memory of 1092	2740	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://steamunlocked.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ffe7afd46f8,0x7ffe7afd4708,0x7ffe7afd4718
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14947087111624407205,8718910896773165751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:3800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
23KB

MD5
51b23726dd367bb2bdd396e5d26b5c85

SHA1
b4f7f397b955084384eb67a760c78b2ac964f508

SHA256
4be4f7c0b4e925c23385c5cc2146f63f0ba77de6e199318c68ae7fbff5d19061

SHA512
bbaa8ba422e21a7a1d574c220b7191b369a570d90ece1a1c64ab412107e9e0cbc17daca87d092c13594cb7a11520ff887f9a0f718c86205c132abefe35af3ce5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
88KB

MD5
72e94d67dad780d3f0727d26e4300585

SHA1
dffd261269d11758dfd62faf734e228fc80b533c

SHA256
1cc300cf2b9d045b46e68e7f2405ab65107c2678ce84a64d387c2abaffdeb4d9

SHA512
3a19fd5c7a1121214d724750e29ba1cab13ac22953451bfff9cf59a704ff0fe7582ddd2cfb58471441558aebb71c1fa476801deef6298b0741841929e0e64cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
2c02c93f84991b16b57e45f40b874900

SHA1
a2db2da84b2e52ba38804052a67cca171e3680f0

SHA256
4080435886c90a952ed07edadd6ac9be4cb2938ce5ed99a4759e4c2b18ba04ed

SHA512
ad5c31e8a6eded165aeb6d4ef4eb895f46d827a1aae7cb95127d1af5810052297d690079299fc029f59bafa2c57d2d6b7f8bf2dd6ff7e38d1b611652a80df6c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
e9e8e9d875e29fce70c6104bd43358f2

SHA1
276871e083d3d2f99c535d752349ce8fcbe884c7

SHA256
94c858291963f73feb9fc8e738bab6c81cd4e23c81ebf49baed7c2f2eb670f26

SHA512
5d006189174a288e553e860d4963811b87ec27144d22d5a13ea4395649a62d6193b2e8f4b1bf695188eee5696c0937fff9c72fe9b365cda5b7a3009477037514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ee1f31e4fb3c5fd2ccc29644cc5c65ad

SHA1
f6bb93d0f9494377fbfbdf00ed97158302693d31

SHA256
e970bd86522ea1001454744fd28b4477baa98e6b25e0c0599b3b55f1157e5417

SHA512
e5ff32af0eecbf6b6ef3b9c6009ddb6f8e6ec5a237e9e39a78dadd07f274550002290d7d99fc518688cafa0338b2d5e0956179638041d6aa377508d75bc30e4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2bde6ca684ea8ffc667efaadead629af

SHA1
fec65fbc35382594ecc8203864e1a0d3ebf2193f

SHA256
321172716c54a40f6277b23061ac942418fab56853ebdfa0e482a4e9e62aa420

SHA512
939b428c882b6d4ee1362b16477eb3aad591abc6c969cf7624f4790f6781a2c744575224d56c1b9ae8275244686e79b2f5bb88e857d1298cd9ea869e3511d888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0fe7cf3a753ac91f80519ae02ef144ab

SHA1
b8141d1ae1b588cda3b09140cf32ab08ecd3364c

SHA256
497569f604c1bf4e8c0dffebc220e2d5a0c6140ab0cd47271e57878e9fc0c0c9

SHA512
f6ce545f783922ecc0b4ffdc1ab03309961c00e1c61569dc083e2378c62abcf00c5f83776ccfd600930efc9398b51e101fc68af7ced23ad71e917174147854a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
67dc23328b8f3af0321c98d5976f9e40

SHA1
5025abae53fb46b937cb8280058027df75064b33

SHA256
54959212b66296eba74c30a5b76e7cfce3639dec8f845b25ca49a3121c9f15d2

SHA512
7ce290375341426b4c911c95c321c5b3c0ba267ed6b04ba80c9c93c24af24c02c10690dbf2e85f426efaa94552c3879d3b8edb36199437ab41ab0c8f10d05d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d7702d17ac369989d18e41ee8245179

SHA1
26da36b9aacffc09c44d6d072ed8a7eb02b5aa38

SHA256
1141d68f7b112c5160369866bec80d4dc3b2db4ca562e62bd19700c8a9797dae

SHA512
6ba7114d3812c3835f445f625a7697e86ec45d65a10cb0cb96017bd39ae975fae8adae6ce130c56d2b3682893f0d3f855df6b0de02483dfbc137e3152011848e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c1bd360438a39e85f87c6c64fa989a9f

SHA1
44385f6ebea8110308a531a84530688964df9d3b

SHA256
a1a0fc17d38e3b6bd2a7a0c322636a0f7ba79cbf05b35fb6cd6df4c93d4d20fc

SHA512
53d9ce28dddff1d8b67cb784c37208b4fe8521879b113d090c63e930f1dc273eeef44c6987b48692c8cda913baf97cde80f625bb526666198c8517beaab64784

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit