hxxp://google[.]com

Analysis

max time kernel
2041s
max time network
2047s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10-12-2024 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
2796	msedge.exe
2796	msedge.exe
2328	msedge.exe
2328	msedge.exe
5720	identity_helper.exe
5720	identity_helper.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3192	2796	msedge.exe	79
PID 2796 wrote to memory of 3192	2796	msedge.exe	79
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 2984	2796	msedge.exe	80
PID 2796 wrote to memory of 3284	2796	msedge.exe	81
PID 2796 wrote to memory of 3284	2796	msedge.exe	81
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82
PID 2796 wrote to memory of 4080	2796	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffca2cf3cb8,0x7ffca2cf3cc8,0x7ffca2cf3cd8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,6226431664118746300,3546861617033580012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
90bec957a5b92929960db61988fadfcb

SHA1
2c58251546e873bd622c7e387c5491e52ab13cc9

SHA256
6028b607ec51da8a6fe1b9951cf0eb037ea25caf52b6d351aa9160b921075180

SHA512
31cad1f34857f044bbc0e3fbcc34c62a310841a145dd1f1fd1ad648e1c52dea0e991686e2b8e3d42029d27ac4e4a63a92adbd61059cd67ab44b8a9e2c9213d9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
63692019321a9fe7b2361ac5ee3bf386

SHA1
4c85d80c20505752600990fcbd6779bbcd4891c2

SHA256
b8b3eb2a7a91d6bcc4cec766ec4fd53b8849c1ce58fb216852b5d9b72c0cd89a

SHA512
d1031bbf2d50db1320c002d81945b8e37f99041a92d8c518aa43b4b57fa5f128baed5745c922144480f230708d91994ae6e18e0a2df48b839ccfebd5517d8de9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45772d650464dbd70bf3a3c75d9d2c43

SHA1
85a41fac4177f140edabbcb26f5c1b3ffbc0c99d

SHA256
962c1d185dee527043e6f89fb61cd983d35118c2d7d0e610551716c2c9d710f0

SHA512
c39f75870d56a0d0be69602f79f33bd074597f893410d30b9276f696e69baac0f10c6b523eac7d55c5b9a7191ad654e9048339f4e2f7760ff0b0d6fce4bd3104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a82d8a7a8e3a54dcc6c8e2876dcc2e5d

SHA1
868f034b165e1aa4cd6b38cc2c4fc15cbcf47a06

SHA256
703cd8c7619eedaad4b231e1b4be831324640d51d99ff7aa7617062dbf06f993

SHA512
5fd2a622078eb6896656a8ba1c128f08895ca17714281edc0a8988e84d1d17972ef9a0b01fbc432b6afe4b40232ed3cbfd8322c4f3e88668ba4f6e5aa6c2b35e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
653b4c1884d5dc99eb3dcba2b8886fc2

SHA1
a2589a565895ef6406df6c54031957a19570514e

SHA256
e45754005b19b9c45b103b02da950163ad4fe2a80b063162fd66cdcb1a1c878b

SHA512
fd1d968763b05889af84309b878dbc93ffedfed80f0627fc5f6865db2a20bbf26adfccff852682756317f7d4de58049ce7fe3a63288f31fae17340b2e8eee800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8bd270a968eda65632558ff360e86167

SHA1
522d4f3b6a83c53e7362a3174d97dd689e1f8212

SHA256
b5e6e6fc02a5adc6e1720cc427effe291ad6904accb38bdc109413541d4b2d71

SHA512
c89039e7b3f9e83105d684028519a03e7840009a1bf754401a64775be54ff6855aa6d275274b56553c1a08bdeb7761aac5a6244fb377f3e2d0de3365791bbd75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fe51cdb237ddadae424bd1353665ec39

SHA1
ae5c9472bde96b1e6b3bf12009c5c96a2c310d90

SHA256
8717e045eece5e38f212a2053e56b5b204c932f80d57a35dd7d5fbd49b57dc65

SHA512
2eec90f07fd20264d06b553beb2c2ad8a78dd0f6472f5a436b473c5cb0b217fa8e71bccc094aec5173ccec20c76d195d23c153c40523f7b709b478dce87b551d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9b749cce533dc074d8d7c75c4468674c

SHA1
b8a2398607cfa3c4fbc0f3f06dd804ad36a863b1

SHA256
67fd97fdf894be535194b9ba6fa93cff522036336ecad3a2f848e873f8a29e53

SHA512
c25a0330945d6bfcc5f131c8e0b9bab30a0ae2d6f1579508adab5fa56874cf6b8e12bb843c44bcaaf91bd40547ba225ed263660487a57336ed7544e4f6e24cf6

Download Submit