c1e84d4b79642db69ec010174c00d5a988acb7ec1c933993380870aa016c6be1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ttakki.html
Size

19KB
MD5

4fc19e6a85964d098500a7f1a3dc310b
SHA1

59980e378ac661f1fd2880f6988f8a6becec6610
SHA256

c1e84d4b79642db69ec010174c00d5a988acb7ec1c933993380870aa016c6be1
SHA512

0046e796fddb823365f054919b9de4efe466c4ab5965a4fc603a8c0249d2b12259351861e44d33893cdf0dee75209dcb7f369e1860e5be038d26a82157f609b2
SSDEEP

384:EIbrUy9iTTPqQBlTvsNWILWqWQX9xZ/MUnD:EIbrUy43qQBCc2Wq/X9xZVnD

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4184	msedge.exe
4184	msedge.exe
3872	msedge.exe
3872	msedge.exe
1020	identity_helper.exe
1020	identity_helper.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4680	3872	msedge.exe	82
PID 3872 wrote to memory of 4680	3872	msedge.exe	82
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 2680	3872	msedge.exe	83
PID 3872 wrote to memory of 4184	3872	msedge.exe	84
PID 3872 wrote to memory of 4184	3872	msedge.exe	84
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85
PID 3872 wrote to memory of 1652	3872	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ttakki.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff807a246f8,0x7ff807a24708,0x7ff807a24718
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,18384306685994545280,17920244874455756910,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007b

Filesize
37KB

MD5
231913fdebabcbe65f4b0052372bde56

SHA1
553909d080e4f210b64dc73292f3a111d5a0781f

SHA256
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad

SHA512
7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
915d0c94f420316c2a0a2d60944db5f1

SHA1
26d3d1272ea9bc3e495e3e8774aced2d4880bcb8

SHA256
76fcd0fa6c801176abfe924dc76e57df1f5a05a7a70d71eb29ad9ab9ecaf8e9f

SHA512
e5eb07bd2b06aa0fc94b27c29564b802cd7c9316d7ff758581cea205e7a5c9a85676155c200dab4dfe2ad33997fa65026a9ce2ddfb4ca97c9cbfc45f82074a9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
937B

MD5
50c3a7be2e9b4bd07a331346ba6c282e

SHA1
f49b6d8cc79a3bcc702835a17bb3fb64b9040efd

SHA256
1269a5c38b427163054bebe28a2e593330aea2d05e8f614fa762fd43b1f4c995

SHA512
7b510cc7239b1c9d3b887b9c1b9df548c3178925b6bbeafbd2cb15406964406c0f89484273df6ee50c773bec8b7b8ff7ca727c86544159b102426abb6b961857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4501f74cc3e839120463478f0502611

SHA1
ba7c8f1075ec934439d609622a1df7ec7cdb5c1d

SHA256
4c1a7b53b44cf302579b904aafcdc63788d31ef5242888923632313779fbca25

SHA512
8675f5b9bcc1fe11a1a2b1a212069d8ec141b481d66c2375aced16be50626efdd2ee3b7ae581d992605858503edcfb26f70d50cc7cd5edcd7bb5e21f00053333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6008683889ea4d84e1ce75d7f7f1273b

SHA1
370a34ccdf2151d32bb0ebc53cced23a94031802

SHA256
3e8ef8d52861ed9a6b7c7b74071127f245a5956e5c27404b202b9c386f712b22

SHA512
575736331df881c07787fa28187b11ab6e7aab350877285f116eefcc42e5b5397e6292aee621493318e2ad550aae28a9522e9790852b365dfddb8d9e148c850d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
507bc42d9ec84aacfab29eec9d348e2c

SHA1
5980d426ae7bf072ed0a826d022addca684f2196

SHA256
7aac3da97dc2eeb0f89bf2465aba32d39fda14f730fc3bf993a9d3219b1021c5

SHA512
04b9999a16bd026b4cd55c5c9c9ad6cabd7395908ba616941e8d1a19d72670f946df255f71a25215fd138e8824b70ffa50e6b7740446d12174c536669b29520a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1e33319e1e6d23c8297fd757a1532141

SHA1
90f73253aedef16e03a45fa2a4073e0829c7eb7b

SHA256
b27b4ee507e5f1cd7c8b05db683abccb048014b9702e5539ab9e9b87afb64c57

SHA512
ae39b0240cf868bd41cbf53888eda2013129075f0b96d3458c2746979e6f99807fbc0cb9eb0a418f37f2e1630e8ff4c9b61b3cf3e15f3c010b002166721733c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b81f2927a0286d51c262566b948b3ad0

SHA1
a0fdaa75d59b0404c2f301925bc5b07f6999fed0

SHA256
fc301eb5bf1656f7ee7a7c1b8f1147588168e12e32ed1d5ff5691a996a5939dc

SHA512
402f81639fe74de71ab16730a3882f69c6c1885ff1da86c9dce8b14607ade7b35f937216b8fe63857f9ad0cf928b1d687500e4ab2773febd40c85b0c62b58e90

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
25a801aecec827a48978c806c5afc5c8

SHA1
32df8e4292f9d335d0349027f1b38ffaabb37687

SHA256
d3083ad61f3568f17fa967cfb22774f79ef3f6f3dc61b9698877c28a0475ec61

SHA512
77c81111fbcdf15f4883cebe794cbf4e49a02a9ae96df82aaea4a2badb8794c2f2a7eaf9050a95d0d6a9fea360491ff1ebf7af87387ff5ab3d9e3e5c30671377

Download Submit