hxxps://steeamcommnity[.]com/utre84/nuber/tres

Resubmissions

17-12-2024 02:49

241217-daz3gsyqhr 10

16-12-2024 20:37

241216-zd9lzszley 10

16-12-2024 19:43

241216-ye7ncaynas 10

Analysis

max time kernel
80s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steeamcommnity.com/utre84/nuber/tres

Score

7^/10

steam discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
484	msedge.exe
484	msedge.exe
3828	identity_helper.exe
3828	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 3704	484	msedge.exe	82
PID 484 wrote to memory of 3704	484	msedge.exe	82
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 4748	484	msedge.exe	83
PID 484 wrote to memory of 2556	484	msedge.exe	84
PID 484 wrote to memory of 2556	484	msedge.exe	84
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85
PID 484 wrote to memory of 2780	484	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steeamcommnity.com/utre84/nuber/tres
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe8646f8,0x7ffdfe864708,0x7ffdfe864718
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,8848358097312490655,14785686013018701401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:1892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dff8946b67053b698a9021f6e0274110

SHA1
a1c02e9d61d5b8b7ad11ff823c6b8bf8a7ceafa7

SHA256
6a9a31b3c96821b7e17d48b8d352b2f669b4cbfb4cbff2f634711e1c016bd1c4

SHA512
c555e9745feef1b66c9a7f0164f5af59924b335a2814335d8939e67d77b012dc91645c9bac73958808710862bcd5c54fd7e5c5ecdaa2f2c8eca1fd9989e7337b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
e0f21bbe6af78015b864ece84cab6956

SHA1
a2cc02c05b5c9774e8a8595f8bf6ac99a2ac68a4

SHA256
5b1b9434438712014f4b24885a97b5a9deaa070db67a417a26bb848525a2b96a

SHA512
8071ede9e25d862757f0e208404157f29da4f1b372ab5ccc30f6c343082ec3740d7ee2c3a1f738180c32fbfb435c799fb37308ac50be8c2df094094a0cb1a2b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e41b175c2193baafc6eebbfbc8d9fd62

SHA1
8302892d6625947a4ccc3679437f0169a1cdab0b

SHA256
a337d7bb6d6ed38db68a056f5e0a223e605398cb78f5a429292051ec41ff2050

SHA512
fd86f2a0678f5b23cfa7c743e1069cddcb15bd24e719fb216288710357b2caca0dc396d7a2a36c9fa0717be065e37bd5c08768f49664f89035ea091325a33936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e5e1b372d091c3bfc018a0809002b5c

SHA1
8cf2bdc948cde0712a8695ea8c9b4b21e5317622

SHA256
40431ac6a2f9a064847920abdba1b7cff0acff97c9c95ab1ee1fd9159c4ca09a

SHA512
c60d16681ee25ee2f3a4a46a1f73767de63114861c440c6fb261ca84f49bedc56d01821dabec7945f39a6a3117158085ee93d3d14d452dce9515d66ab0b14fa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1c44051fe01fee5e96bffe2aa3b2c185

SHA1
b2088d6159596fd0f0e48fbc0fa4846792cc8d69

SHA256
191ce1453164c482c989de757ac2ffa407fb268107879080b05b6b40b13c9b5e

SHA512
01ebe64dd2c61e1c36ff88eca2a311a44c8ed0be97abe664a94af0910c148fa504c6e1d2b1349fa1bcdde3a74e05fafafbaf756c9b781657974e392eab3bd66c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f977fde9cd0ce56ebe4bb76165b0021

SHA1
8c3085c75936d19c862c22e3a3984cb3cba415ee

SHA256
177e19f0dc41835b1ca9cec3ac643d6050e104315f6a1089c3170cdc3e78a8e2

SHA512
9d2fe72b08b9f8596f7ead20e214345b4d8b4756a525455957d614d50093cef645a3f97904db0f5cc38c45f76591b66b9d38c3b11bbfd3518a9ec3cda9194fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
68d3b4e6a69ef76a8764cfb5ddb27b94

SHA1
0fa385b2804871084da9f41244a8b5839c12da25

SHA256
ddf1be6362ab45ef5a3924c474227e7e5ffbc6e4ad8218d15e0017dfc61e403f

SHA512
87b8168a977aba42fd6ed674bac823a65999aa72ac3898f7954ddd25cdbc0d44b132e3140129b95257e0c3cc690dee07c8b4dc3bfdf3e3f1656ff5d36965fdf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
420423251a12d1b4685c81b98bff6cd7

SHA1
ffbb6451bd09c2feb3e6ec1edf9ec0242836603e

SHA256
6a56549ccc018fd2319104766cb9c82dd87bc6cf86379762a891515eda0a692c

SHA512
b1f4d8cdca260f715dd828aceffc0ea726e0dc2d4ec1f33227226ae336c13673e2f7427260b33973ca5ce252423a052ae236fdc923a7ec75552dba03100c2316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5802d9.TMP

Filesize
874B

MD5
60dd82fade916f0e33592cbcb15cc36e

SHA1
012fe111d639ac1a65317dc042f2633d1c2fd6b4

SHA256
de39d2cbe4ede1236d8149a1cd03f5526329be5b75efbac7d01bca2c014af089

SHA512
a7ff80a4232781cb3601f53fc089000b52097faf5e21f9656038e4b3e5edaa5e23bc84e5de30dbafa82d940daf7aa62f60beee8e1fd6947a3d6475ab18a79303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e0b982dd400308c2d9557f67aa6e71cd

SHA1
4281bfba7094bc5f3dc9441e4d6c3bded4d08bf3

SHA256
a474ed31590502cf320a833ef690111512793d11625b552cb1974acff04f923f

SHA512
d6067454aad7641af0ba9296830d51d88e89dee54dbdf16c46c522bf4508fc1ac1189def36b3bd9907deb603acb857178b6d731c78207638825537846713401f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit