hxxps://steeamcommnity[.]com

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20241007-de
resource tags

arch:x64arch:x86image:win11-20241007-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
14-12-2024 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steeamcommnity.com

Score

7^/10

steam discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
2756	msedge.exe
2756	msedge.exe
4344	msedge.exe
4344	msedge.exe
2584	identity_helper.exe
2584	identity_helper.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 572	2756	msedge.exe	77
PID 2756 wrote to memory of 572	2756	msedge.exe	77
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 4932	2756	msedge.exe	78
PID 2756 wrote to memory of 3484	2756	msedge.exe	79
PID 2756 wrote to memory of 3484	2756	msedge.exe	79
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80
PID 2756 wrote to memory of 3524	2756	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steeamcommnity.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffbee93cb8,0x7fffbee93cc8,0x7fffbee93cd8
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1652 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --service-sandbox-type=collections --mojo-platform-channel-handle=3864 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,834593089864677196,8166917858489182474,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
43KB

MD5
7f2c172ca810d85c0596390b4ab21df3

SHA1
d4acb412e626e744609aa326247bd7eeec469bec

SHA256
4ccac6b00b8d6b7bec9886d8a23d84131bed955d995a37b5017196b03d1edab6

SHA512
961fd847cdc7b7c54dcb5ec19e3446701de454e9d06e1e2025360a1d0b426d204fb8aec90b854c7b2dbe3153aa66b5d90ba56f8ac6a8bc996177642d6f55c263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f357ac6a99715dc9078b06c576a93f76

SHA1
854b9b1abe6b8b8be5a197ae891d5295f384d0a0

SHA256
5dea96bc2dd86f597b1293e0a94734320107ab38a2958dfeb7dd98174d5f6742

SHA512
8c4e496c47ffff08f334543a1c562fa3589feb70790fd72cb1ec4b645e71eeda6bf4661d953f9720fad870d8c6812f407d8f5297bce0e47d554e3a2284bb174e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a0c808730415a7a900762a2a29a7a596

SHA1
544f9b389d96d0c4283bfb25c9d8e8cb4eb6a832

SHA256
cb361850739181c5fe8c8dcf27491534d6d13f34f88deb2fa46e601f98f4ca9e

SHA512
c6e3d43a9cbd56e0eec35fd6a11b9814b4e30316bbd5756ef26853134ea484203d648169f815f692a74090ffa19864cd745956f059746274372df8e04a13a066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
672B

MD5
d004b7811e62da6d8c1dd214081f0c47

SHA1
50d1663118dca7e58376dc36c0dc340768847c71

SHA256
1970f60f9d1eb416d6cb64abb407bb12b1ca02c98406b845ce6d611753a9f682

SHA512
cafddebdf2b3c0f2fb285776928e3f2fbf053b88ce72d2bbbc3fa2030074ecaa10059ce1f5b3f58aaffa9ca9d866cac082fe1fccbcca5096a1d4697762a27b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
637B

MD5
927f546ffa8dd10c2a8533f9e7b2361a

SHA1
12d6a7e7806db26b67da82551d4ced7458844336

SHA256
4619cd5d20df5c12c5e314b98c613dab1af6d5922624fa198d7fef43ac4bc50f

SHA512
7011fd201726618bc76264b5f50a20e258c26806b1850e12f0008330008676e58152c92ffffad14476237ca0d1b44aab3264f96efc5aa2c96d99362b812f92d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
954811b0c2d6494e494f70d1ea3e86fd

SHA1
c7477ce5047d5a926231056356412fcf9d8aba99

SHA256
7c3e671bd430e2c61b2e9b78c7b710b60db733cef3a34e4f9b07d2c49584f7a7

SHA512
af68ae0f3ccc3ec200a85e52205553d7c6b4925431796b1e876ec6b9c82208edf810fddefdc9fff9081176b8592fb22048cd33dbae6051cc8b53bf03da1357ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ceebacab4d756c6b3b41739b966924e1

SHA1
1d42cb95dae282e58da9d0d178e7c6ed57dacaf8

SHA256
ec5784fe48d1772b4b53d80d46c87648d9057e684f06aea5c5ba62d9e516aea4

SHA512
e486e4a1fa4cb9af410ab3a36d36b2f70e71545630dec03a6f386886908f63a6cb5c30745786054f7f36fc6f59341f7a9fdf1e32cf5b2b315c82bf79e809e90c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9cd2bd43fb41af49eaa6750f4eeb6e7

SHA1
3fa76b4cc6655f4ba51cca2feef8546c035f6716

SHA256
4cc4529dd46dde2d74d9c2ce185daf87ba83f84252913b7bf8997cbc5f1bc02c

SHA512
4ccc1e38b93042099de4a8cd98ad4b2e50b361bd469392dc7fed8104bc72e12ac5640a9c62e147207d411b0917b8dce3871b216d25aa7d1e4ae2f3e9d13409e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10883722a50dc3d6c9547105f40d1f7a

SHA1
6c12ff1c0134f27990e96bd596759e0512c02069

SHA256
83ea199cb6c81ce34ee2aaaee4a7c309fe43ee9ccf8bfe56971c68769d4f67b9

SHA512
8931d8b4b640054a71abf644cfed67f5350215ef4a3ae6bc041d7d28d58d50b62d1ac61d839f6a2df4480373d3b9e523d0c75e7c0b3476e7108c2603316721e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b86a96ca89650206e627f97f4a24922e

SHA1
dca6f4ab815ea0cc72a8ca2a1cc7a620678ad07d

SHA256
a358777b030823d3819f34c5f4d81ad8acc670a255697d8aa6b5eb3cfff148ef

SHA512
035fb13b44edb742d917e5993ae2675770d1e66a74e5d35802fab7e1d33a099a2920ab3d229327e45737ae3cb35c6537f72f0169eeae0b1c6cbcf09185a6d9f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
cd40518e70e05be38a55f7c8354e8619

SHA1
214396bd406751f21d7b1c4b874829b256d908a0

SHA256
645b9c6ae07e2e80550292fa2314e2e583f8b105cfa238be3cafbb623ccd9a96

SHA512
48a0c1eff8a0fb4fbcade7f0d79c95d8fd337d3ba636ab24de93b45752580a3b53782210fe47b1eac549909831d438de9c5b9fd6202ccb2690214a27d948aec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
c2ee66423d395510bdf4769d1d7258f3

SHA1
42bbe4a543492eddc9bfb5084bdba7138781ac1d

SHA256
5ac00fb1361576037812e317e6513f481a69007000971a9fe63df4a498af0262

SHA512
dad27f12997f62d96f60993e62b4d145a47353ff8b08ed301323d509f55f19d567bc53684c217dfbc787770297f97b81dfbd8ab79bbc68b798e723374294933f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582e9d.TMP

Filesize
203B

MD5
cc49168c81c325d6706c625866d40ff2

SHA1
eb1d113bd0f9316d4961ea8d262cac73f8d5a19d

SHA256
4223341484f52161cb707c755bcafca3a86bedd75181334255b9ca43eddbe47f

SHA512
16f4d561acfd7245e47c9bc58e8d1413cea47148ae6b66efb616ba5051cf00a6dee636dbd0c0e40ccdb23ca3670369d9877546336431e1a83307b110a64f3387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f2e28b10330437cf4b589c4278743a41

SHA1
ae4dabdf0fe0e5b1993121645ae2a5dbdcdf36f7

SHA256
6e208aa1dfa3687338e841d0e1217c9cf18dbdc99b9e17acef75e80806a33091

SHA512
b3b805801f667db3c135f63145ffc1e03cc65ef8e2feb184b8a0dc1e20e361f7015806271ea687b98f9895badcb0816adbb0f9bc4f3631ca650b77023aa1ff29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
99e0459676773b21ca9b046788d0a6f4

SHA1
e68a6ba387d2d7d93bb8080727dd442ab9727447

SHA256
8879c037a6f0547b5719e2114bbbf115bf7e8175c643967205bb123a41c83042

SHA512
a0613abd9581e91bab1413de62e9b0925a651d41797c2737275f021c4c7850a61e37c6be7466e1756195c23fc78fb13c9cf3b2c047d835c21217b28a34256dbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c632d64d1b1fefe12f71f7da2245a599

SHA1
9e88433f295c36a825a7a9926138aae302a0c034

SHA256
d7cac5d76384556bfefa7ca0773016d947158d14d12915f5c50ffcfa66f28ed9

SHA512
eae816016e1b0fdbca9321ea2752678d6dc814940289fac18687a1b83070e3d7cf0035aff77c629106335a8114dd23da9bbfe707175a1d617b14ff9562bf0308

Download Submit