hxxp://steamcommunity[.]com/gift-card/pay/50

Analysis

max time kernel
147s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
09/12/2024, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://steamcommunity.com/gift-card/pay/50

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe
3464	msedge.exe
3464	msedge.exe
2184	identity_helper.exe
2184	identity_helper.exe
2156	msedge.exe
2156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 2092	3464	msedge.exe	77
PID 3464 wrote to memory of 2092	3464	msedge.exe	77
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 2740	3464	msedge.exe	78
PID 3464 wrote to memory of 1644	3464	msedge.exe	79
PID 3464 wrote to memory of 1644	3464	msedge.exe	79
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80
PID 3464 wrote to memory of 1884	3464	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://steamcommunity.com/gift-card/pay/50
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ff895623cb8,0x7ff895623cc8,0x7ff895623cd8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,12569176407626065386,5324735634846449206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f83a605bdf348a096ebd5892f96ecf09

SHA1
842a728a800700644233269bd8b37c7130cdf6ef

SHA256
31814faf6b44996081899523cf255c0af9f4d0b3d22926ca28f1848df049dd2f

SHA512
794e648b3a9cb1f9ba8f768ba47f038cebfac9a76281796920113b1a9f78a5e9c0698cdad3f6177a7e99ffa1b4904047b2ff72762f61c2040a154e7704a0dcc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
328f46d072a614936eab92a8f075f34e

SHA1
ca3206d2e82037be03408d95664fc5e41a3a56a9

SHA256
8553dd8fb5be1c10280cdc5678c2b1ccd2fbab4d44da338abd9282ca453a3bc0

SHA512
23eb76b24926653174bf58b5be52b73305e50fb38f81c0fecdcbba5f6070931807c492c98bde03ad215fcefa26446a7f2da2492ee9649affb542a78ff424f73d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b141a50c52df217cd6e04a067e126285

SHA1
3bb353b1c9dc760fbccb6fd8381273f25b5d0a13

SHA256
482a97f24f0e9b8204b162e18e09b0662220967eedd6359d5d39238716c9dcdc

SHA512
c16352fa44899f28f36ade5a8c4e4aced19029525325ec00b8c0ae04fe0cba12c7ff0a1c797dab8ea7f8168898d590c381bde4a2138a9aba1f989bf31b2321f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ea8eaa50b845a1a2aca5caf2d8cef49

SHA1
7cdd895ebdf3f8bbf55d93ca40cd039e1c8dc115

SHA256
71ba0b373819b3982f410f2d69a68fc0ad83936f579d81889634cb7cd8c357bd

SHA512
46e8e3402c0bbf6fc1b4f8766476b56db451db338a88031d8c7d5e032b914d008e645f29c1defe400d108c111fe0e730d317dc5947b6b8746f707688c3a0433c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd817f8a94251a1ad8e3073b3f85fd5e

SHA1
50fccea15faf06c529b757185f4a4e0f588eddab

SHA256
3ceee92953fec6ac84912f4c1bd811cab75f2067e5b6d19e3e9307922c558bc3

SHA512
bc2a8b30ab5b33ff3f3acad8aad225ed0cf30199862c0cb8e647074cd6d6765249c89bc2cf7ba0dc2805aa7830c0d8d07a3e915a1032ab36be85d6a6d5458acc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
42d23d24ede8acd1963aeedd81b7d08f

SHA1
ba78f088590ff17da235e82c10bd6f713375038f

SHA256
96dce11bd90d56ed45a828fe05038ec5059ebb1f13670fc44fdc7258efabacbd

SHA512
b7c68ae4e75b6a8c0b28a4a66887e7d9feade5cd3546c8097c58d835f56bee286651cba7a174116b5c3227f5d412b3d4599d8f9edf79c2a3ba92944471c432c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
199ab6c98970ecedebc6c77df0dbe259

SHA1
e3c0bd3775cf4afbc6e0e2269484191e6a6410ea

SHA256
557d722cf26db5e266fe20fc43d6329381d176a1c2ca8c95589a48e0b0d2d951

SHA512
6c390dabfc53b96a4d3bcf82ddb8db82f234503b447ad28c0442ba5ad693e21fa65b275e0a9a0eb7dc11cb48661df2b540b9d4c3f3fceb1225c57c6cb4f57cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
95aed1d3ef3719bb8690c0926379c1a6

SHA1
e94a91607f2ed5fc5c55bd98e9f7ce82fcba0afc

SHA256
86b651efd3e1aa6db9dec71776ad532464807a59a673ffacc1c32db0ba1149e2

SHA512
6f97183b40d5e6e96b3c4bbb2c31f01675cd76c9b527129d64f76a6a2d8a16c085b1cad757f60d96115740fc9ed36707064462efbfdab2396970c9b50d018ab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cd5ee918c459d3ce498e69ba578006cb

SHA1
b720b305081fa51166675c93932964306485c975

SHA256
f5162f2ae1e5036e6ffcd8bc55a2c3cfcaf71b9529b91a186b136ec2a4347e7f

SHA512
d3eb62fab41e8d28304306d5a29a7a850e4fdf4e8fed769d124b2396f93766ca3712336f8fef71377d645bbbb05b3f2395422df2b362324354bd37c3f82a2417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582aa5.TMP

Filesize
201B

MD5
c7edaabd1b054a8525c5b500025aa0dd

SHA1
14396f26f7cc96c4b014bab01d9397a052b78ee5

SHA256
17a4dbfb656832710fe159fc6acb3fad16869398204aab3104a5aac34f85d0c4

SHA512
34784a2fb720cc9127b7418d71f258d17c78bd2151fd82b6cb70bc17b4f475143087a074a523e0c6dd791aeb1af993df28b71e2f26e85712f4b39e259354c268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
81d11c8380d08ddd6286e6c2927e26f4

SHA1
5a7a3cd6acae9dcc4d6e82e8c93d7d4901b5ae04

SHA256
f10342156867c5c858cee3845dba4763ab14d66ac54359884b292c9b81a82d9a

SHA512
750f83e2900850e6d8f15d74791848cc892ee4dd5cb9f60599ce1b05fd6920c57254338f68b5c7dce4bc138cff41ffef27802b8f84b7181c2a81c5b998b8b07d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fefd1148327c79ce528d851d6dcde54d

SHA1
641ff8913944348331b95038179eb56f3611f604

SHA256
b137680d232da3771581fa9c6babc98c9f927225abde1f1c2e36fcd41127a0d5

SHA512
6b1283461dbc189836c502bdaa83ee302a32fbe1380244630d224a6e230d530578cff4ec8ae631f37b15cfef46cd7a00c98d8f7b6b1669e0f9f5e45b39d6d532

Download Submit