hxxps://steam[.]communityworksuser[.]com/filedetails/sharedfiles/id=548496547

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steam.communityworksuser.com/filedetails/sharedfiles/id=548496547

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4980	msedge.exe
4980	msedge.exe
1608	identity_helper.exe
1608	identity_helper.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4032	4980	msedge.exe	83
PID 4980 wrote to memory of 4032	4980	msedge.exe	83
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 2160	4980	msedge.exe	84
PID 4980 wrote to memory of 4476	4980	msedge.exe	85
PID 4980 wrote to memory of 4476	4980	msedge.exe	85
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86
PID 4980 wrote to memory of 1476	4980	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steam.communityworksuser.com/filedetails/sharedfiles/id=548496547
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa1fc146f8,0x7ffa1fc14708,0x7ffa1fc14718
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2028 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,7035562569734790306,14410929158462503094,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4688 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
fcd8644fb89cfe473cfd2dbd505ae29f

SHA1
4c0b28d79bbcd0fd39f2e54a40fd6d3235634ad6

SHA256
c67c85bc92cefaad639a2831b4dbecf034d57db14a318aba1644063fcfc9cd01

SHA512
418139a5b88e7783e8bb072a0ad2c4088705e7612968cdae35864cafbb9845bb75f05a386e97fcc6d2c7d1e022eb1e9b736063f098ab41e84cd4257b0bd8d4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
511476248ffbadb60cb3fcac51cc3149

SHA1
b6fce71d024432223cd7a12ea9dba11d7d81103c

SHA256
70b5aa65b35b78ba1c6f51d4f6a25497117e27825d94d51e759257c60c970104

SHA512
a0ab6f52dc067b80f6f07ff3b71ae132e3ee7122be000c1377128b8bfd6fdfb54d5ab14301bcf205e60de5c9cd9c25d071e900778e43f8464cd3e4eb72d378b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
caf4240813a8c86acddebe498baadea2

SHA1
bbc161790d5a920a458c23e2ced5cdde75010cd2

SHA256
abc674c38395836c1f2d6a3c272f8e22fdf5135dad6298af731036326b87b941

SHA512
eeeb56dd76060928f55ff053a60ec83dba76251b7f99799aefb9e0f7e31ec933d1ea07bc965573e4f5179e88c1d235c7bf06c685d2be3d3e1e0489361d702c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
4e00306b43c1d2e65c9a595309dfda20

SHA1
57d0e38c7347489ec1c6b86b2813784d65e48e18

SHA256
04b41728bb716aeaa03b757a6eb0fd8cb6d81ec520ca177ccc57348ca964b709

SHA512
d873d8bd1e5a95fb082fdbde1ce50f45e3a82d23d6a34846743d83ca6c42bfd9a6e75c0b2cdd5d9baf8e36d640693d0566f6f861eee568a1dd8433154288bb60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
557e4f7a23d9188901da6b7fe3055a68

SHA1
889aba719698d197916e3aee43353c404e3f029a

SHA256
20babc81ed9c2ed34b5457147a73948a59abbc754168e7ed6800d5e93f2d7fac

SHA512
4bd1851f032c273a99b474ff44d27f109ecae482bff1d3940aed1fa258e75bba3d6fe083bc1d527787bdf9f29c34589e5ef48a056774eb500d17c70937423ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b681e29f16e662137466f1029fd341ea

SHA1
2555fef0a5e980d5d1a36181169fd2242b35a116

SHA256
37d5bb1ad1f499d2d5fade174bd51ca7dd46b6ec71f35ccf1da5f168c991a7b5

SHA512
78d2af2aaa8287abf05dbfb642a9c5437553e57df62725d03688377c1d5af5a009d99acbc442f7cac049dca63215d21edc8656e4ef2ab80c500b9fce1b0b4081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a63e0987472af2e84666142e1c7a80f

SHA1
44047a7660020cafa8c7a29c463a0172fbf989d1

SHA256
bb15ac101dd059176a72199902136d73d59dcf2c2a749645855330a641fab6eb

SHA512
a296d845173a7476ec72e316ac8f1f1d181d7dcd2ec09a645da78a1066696e2fef0e12be44e6784d263a2375d029d438372a107be37ad3e1e572a6fd24216273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a00a020a-9668-480c-b0ad-7951c0306b3d.tmp

Filesize
706B

MD5
8ce6629a5c59010878cbd5458158f8ed

SHA1
aa0464fa771c35872f8e474714281f345612d1bb

SHA256
1b64a6f004d4a09d0fa528a3a0162cf83a02807278a94ee067cd2232c1ab8019

SHA512
044c074e23583850faca0c0fc93fc96c97894279d00652b648baf26d65f08d74737872c3aa42ab0829aa60b1c88e933a796ae6e797f42fe5fa12beb4b3465aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
868c7ef5d067338bac974717f6c8a467

SHA1
ca877e52ba94c2f37ec984146c95d7cba4bd2912

SHA256
68216f6075f97e99a341c67108bce87722f2db4c267b258a8968ea111d2b001b

SHA512
23c84d7e0e532d4028a5d4863ae88003712d4482d94f791c769b5b620a35bc5aeb6fd3c02264f98418086d59df0137fb46e48e4470cfc5885b529bcbb9e68803

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit