hxxps://steam[.]workshopcommentary[.]com/sharedfiles/filesdetails/AK-47_Unbreakable_Bond/

Resubmissions

26-12-2024 12:27

241226-pmxnnsvqez 3

26-12-2024 12:18

241226-pgr61avpew 5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 12:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://steam.workshopcommentary.com/sharedfiles/filesdetails/AK-47_Unbreakable_Bond/

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1756	msedge.exe
1756	msedge.exe
4544	identity_helper.exe
4544	identity_helper.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe
1756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 4260	1756	msedge.exe	82
PID 1756 wrote to memory of 4260	1756	msedge.exe	82
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 3712	1756	msedge.exe	83
PID 1756 wrote to memory of 1744	1756	msedge.exe	84
PID 1756 wrote to memory of 1744	1756	msedge.exe	84
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85
PID 1756 wrote to memory of 3144	1756	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steam.workshopcommentary.com/sharedfiles/filesdetails/AK-47_Unbreakable_Bond/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc13cc46f8,0x7ffc13cc4708,0x7ffc13cc4718
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15854513502813274130,16110749122416861108,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
f11a5e6703f670ae2c3958656abb2963

SHA1
825955fb8f43ec25a48927c3145ff585dc5f28a0

SHA256
99435f0af84298dc96125f30c45e629953676082834918414881037d011a6802

SHA512
dc30803cd9acabb178ebd772f6a48c0bfc3a2f57a336daa4a89b7c359832c1b13a4af8b98e2e540d9fbf8f34778f694fe2d634bd2bd78210b06e1ba016b18153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
866B

MD5
b35bca69424130426a3518982ab3ca6f

SHA1
e9d2201b9c886c0c1c1f919effd1a7cec3dd67dc

SHA256
c49f3e6af689127ebcb205a1579f9dd12b97502022f7d11f2127bd80b67b3adb

SHA512
b69484280b5c419094631d725f42214b42a7a09cecfd0de530433a10d71dc14858e994a99d26992dd27a526e2e316e88961831dbcfdc49b5395d76930dcb0778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
314336a2a04f62e06e38cf4c17d0e4f2

SHA1
9be22bc2e99b044ff8d117b8a2e27bac4def2f80

SHA256
eaceb35c29bc49c1ca13599e95434cb0a7c51013083edef0659c11fbf4b50763

SHA512
82704019353fc620e21280743bed9170fe4211c6ab9cb95e81e39b1d3815220af51c7e5edab501ef44c3f4e8181994a818f6e5da05d74a2451f5f46877dc6463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa80e2b91ab6a77db7015d7f6c197e73

SHA1
752215533042222fea972f9f26af8292e2eb06a5

SHA256
73f606fb7b3452f0c5ab651a12f856fc952952cfdae8cf01d77255f297c6cb9c

SHA512
215dea782a4ec595d13885c3c88d8cbe0cf20c5bcf05fd5b54fab5cc88f789f7a04329a66cae7f4d65733b0749cd6f88deaa13688c83d3ba7a01f6595a5c4f96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f8fa77a3255a2eb88c1a428a1797f35

SHA1
9cf102626670daeaa9c4c217d1b6a4766418c8c9

SHA256
79f31e79c54d78ed6a13262d565beda9a38a33eb83cd32f7ccedfa32a2172831

SHA512
f77cd90727bfc9966ead53ed59a8d44933353249596cc390ecf298ada33feaf501147a3ab031c6c764250b4f8fbc295d0e8cd216abf37293e4fc5eaff40bbd0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ca879a6e9704fdf87306d4a9dcc1c9c3

SHA1
498bc9997c66bb322c859b3c8a7185344e57789f

SHA256
ace9ed698d1367d3fb55af55375ce73c56c9471b8b9006ac82056f692c985b06

SHA512
52d2e6ecd34955730acf0fc52a7fc555f3e8815b32d5569404f20f55b4a72523c166c162cbe43eb457cee7943519103fa4665aef669228f4885c3507eada8cd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e81273b28909f04f573c15ce48ab813f

SHA1
b6d9868f6cf27db1f991bdff1da0875010735caa

SHA256
726207a1d69e55dc1e818f79b9ff941948665465dc9953e67863cd8cb7a80648

SHA512
50054f7e628efd6a1757d4eb3e02abd50f3a43cda076e253b133a27ddff45d1f8d036a4b185ca52eb4f56ba5595bff0362627c7d1e7fcc74a2798588b3eee796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
dd2698a6f6031f880efc50e1fe9920bb

SHA1
8e1135ed18c6a9d0cee40f56a30c26e456932131

SHA256
5f8aeb9cc7a3f71018f0f4a09fe38327012587b63652135254c6e045afbfa62e

SHA512
fc42c9777b97b60bc644650c2c3a602913078d3c1c92d2f50f6b9578ded384d3d18ec025cb4bf480168fbe70e9b78f9fa922c77c298bf647403259da277de6a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582fc5.TMP

Filesize
540B

MD5
f74111a2550e8cba4b20638e64892cd0

SHA1
90e3e30966cf40feee6af4d16e6810b763d26fa3

SHA256
f82011b9cec2b70b97f33adcf2466a7132c45c507cca09079a1ec80d29e99f3a

SHA512
279a531e4c6098fd8174dd3c4ac4d740cbbfcaa60dd89cbb21dea6db34394ec9dd5009496659e23a3128ae3e2b172b6d5f953fc4e05f37bbaf87296c6401d878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a3b2784a5c8bf80c703ba678c04b6a39

SHA1
6653bc4fb007c32b9bf63bd0cc721053fcf0ab40

SHA256
7e1f6f1ace936336bc407f6b75c4b5d39bba9cbbb69704a9729a56e0dac1032b

SHA512
639c9f240f7e7289fc4e48bbc1d004d22578a8ceb9689ecf2e8f2d7dff56596a0d7d57941bb6bfe7546e47ac89c719fae5ac4b526bc2b6ce735e1228efe542af

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit