hxxps://csbounty[.]com

Analysis

max time kernel
1713s
max time network
1684s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://csbounty.com

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3616	msedge.exe
3616	msedge.exe
4508	identity_helper.exe
4508	identity_helper.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe
2800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1392	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1392	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 3096	3616	msedge.exe	82
PID 3616 wrote to memory of 3096	3616	msedge.exe	82
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 4776	3616	msedge.exe	83
PID 3616 wrote to memory of 3804	3616	msedge.exe	84
PID 3616 wrote to memory of 3804	3616	msedge.exe	84
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85
PID 3616 wrote to memory of 2356	3616	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://csbounty.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab23f46f8,0x7ffab23f4708,0x7ffab23f4718
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,8252342382699741172,13082603043101784959,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
36KB

MD5
80c484a058ca2ae0f9bc62a38223d496

SHA1
8315360b781e7161b79df6bc8def9a66db7530a9

SHA256
d7530b224b4842c08b3bd6e33a059d33cff50653f06b3080504785c6c3997c7a

SHA512
5b3aa4494da9bed0fc7e7fefe00e8343e3e63322b7923bbb959a0d274716da283cbea5ebc4b59f4e508b8167c32479ffa3ce8b36465c6563bc20101aad9f8608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0655e88d0788c2e77f18568fc30f6a01

SHA1
62af4597301466666c26074548ff70187c4975ea

SHA256
9b6f9118bee6a4413f8170a03e65b4e83303425668d1d2eb73f83a7f919de5f5

SHA512
0e125fd2ccf9a691df7ee7d3a6c9fcc61611ef76682688a461b3664177e906ea3e8a2401c83526c28838c5b4abbb68214be2421f5b8ee3946af011ef433a0ce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ff10a8d4405f04130c4fa15aca551419

SHA1
3045332bc9475c44bccd6da6dbcc0b1fc069d0fb

SHA256
5b50a1d4508f9d57ff22bf8da64fa0ff2c81b679cfd0b6ffdc4489e256985ede

SHA512
173d063db0a4a9d9247a69224153094fb054a8716e950b9bd628837232b1298063c5812651ba550bacbfc5bd8232d260622838799cc6719c2bd9b2fcbcd2071f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
294df164c5371389eeb4029058a27876

SHA1
2d208c64fdf80ae11763c657e17477862233361c

SHA256
8d0ce4fd2d5f9ee492db16b98d8b28d8f2ee782c4f5eaf6df53d52502eff1b5d

SHA512
1136dc8881935c0293adf9a9b8b67e3533ac9c0c92331c5de823af386f8a112fb08588d13544ab576327ddaf8626c8ba92588c998f428295db1c33d4ce9ef3f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e44c2e9253ae861cec44cc2a0bc5337

SHA1
f1a2a494660ba368833d4ecfe66dd8444ecca008

SHA256
ade11166d56f018f64472028fa563cceeb9d9d4f535259916041c2c7522bb0de

SHA512
6e83fd41eb27f3c3282587649eed74f28d7c5b2c11438bd21ca6630f62f2f12949b1d212cdb728e2ca070f0ea52df94dee8d05b79b62787e1b71284cd138f83b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
161561b4442189010c2234932a5dbd69

SHA1
7e071f9e004a1603e0c27225ffa1cbae444ca5f3

SHA256
cf3cecd1aebc45fbaec58d06fe444b2133791fc090bcc57005fffa59f4c5bae3

SHA512
f30672b683843693cf5917a63e24ccdd56e57a02c92db1f911ba9da9c7d8d4736125fbe34122a44ea4dc868d848fb46099fd1654fe2fff5b14d8d1fb5bfd9555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
acc369adb1d62f39e86ccc057edb6940

SHA1
0046fb19f3029f922c1376608e987b48e2fa030b

SHA256
db14c91a5ed58eb5a3da4281e9ff56e03a729acc0710606e6d9ca79e32e04bf7

SHA512
c26c3863d3db2c7aeb9ab31bffb5be27df297d24ad511a7a8c3b53e5b022af61421f8df4847a1fe2a16ba3cceb200fee7549cddb7c57c7314002261b465f29f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
702B

MD5
e76bd9d7502219c97e90e50245c61336

SHA1
c4e279a7249028fd347e6998e97c15fd5b71d739

SHA256
8d12eb91daa66e57a6a91c0bc933967d294c372382419e6681688fe1c6d68898

SHA512
0b921947b851c18e78292a91c185af19e0ff9b3ad176cb65847a1bc3cd0288d9e28141fa309e96df495c017fcbea1e1e4912fe8a01ea3fbe347a8a4b2167c0cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
8be8bb94fdb9b0548a72e7630c0f681c

SHA1
6dd1509c5f8f16eb6786bc2c607b1593a6d0f392

SHA256
d4df023b373a4f88b871a5a596948ed0bbea6062f42ab8fb13fff3ea9530bd42

SHA512
699831e924300f4a34c1375b7b8a1a3f9844fb340d59001b74267fa40ebf746684d6bfb8de882c581a8935ad5757a55ba19d265750b18903d05d7a4787602c78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f3a7.TMP

Filesize
532B

MD5
97f4c44681cc8c2d5e48eca6c500965f

SHA1
cbdb5a2b202e59afed71fb0070ca830413bbd41d

SHA256
ec80a3aff9f6b0c0494e24f6dbf624430dd79be178e5bf81d98a1239f8f347c7

SHA512
ac26f8d4fce3cf35d8563f8b6c461d2ded5d29b589bdb21792d44b6eb5c315c01e5691b454b6c1db22c4207ce1c52e3b9683a3e8fe708f23e12f4913661cebee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e9c41cf7e41d5714545b38e796bf7d61

SHA1
135aee6dd83342890df33f2bb40bbc8b7b3a0bae

SHA256
bceeac43d413dfd57b99f1c156132204d1518580d23d70a4b925ed4673f07b39

SHA512
9b6d65a3b29171b48202c53c6b8c336ef1875a57bfb091f4d96dd7173940014df730445af670ebafb5d29b05e88698084c95cd59cfa48019ad6b9167d5855e5c

Download Submit