e393ef21f5eb81b898f79f4c53c58396fa161a425ea9a07cefb5a3fd55c1aa7b

Analysis

max time kernel
100s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2024 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

43KB
MD5

e77fe874263674ab8f5b85326b8ec851
SHA1

320b8aa1d7b0320eba19cb721ef4240c39a6d2c8
SHA256

e393ef21f5eb81b898f79f4c53c58396fa161a425ea9a07cefb5a3fd55c1aa7b
SHA512

3b2fc00a330a5b4d4c049f4b55f033f81263aa8d07b0d84b418a0e7115f882ac3cd9bcfe7312ee8ef82f33c0b4821570280e8671d84865ca04815d0bb7cc4b9f
SSDEEP

768:D3BpqhYGM4evT3x8gAts0s719TFXWt7aXfsW9l+X9hJYFnzOMD5QBdxaXfsW9l+d:jB8hYGM4evT3x8gAts0s719RC7aXfsWq

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
5008	msedge.exe
5008	msedge.exe
4464	identity_helper.exe
4464	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 628	5008	msedge.exe	84
PID 5008 wrote to memory of 628	5008	msedge.exe	84
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 1436	5008	msedge.exe	85
PID 5008 wrote to memory of 4528	5008	msedge.exe	86
PID 5008 wrote to memory of 4528	5008	msedge.exe	86
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87
PID 5008 wrote to memory of 2948	5008	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd4b146f8,0x7ffbd4b14708,0x7ffbd4b14718
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1148 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11505927998638842749,4597792522228676071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
36KB

MD5
80c484a058ca2ae0f9bc62a38223d496

SHA1
8315360b781e7161b79df6bc8def9a66db7530a9

SHA256
d7530b224b4842c08b3bd6e33a059d33cff50653f06b3080504785c6c3997c7a

SHA512
5b3aa4494da9bed0fc7e7fefe00e8343e3e63322b7923bbb959a0d274716da283cbea5ebc4b59f4e508b8167c32479ffa3ce8b36465c6563bc20101aad9f8608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
36KB

MD5
21f4955f4e7a07d5cae4a46fc74ab263

SHA1
3e3e25ca71bb03ce2c9b2a495b346b9653568b1d

SHA256
0870954849b1ccc0e6a9754cfbd3ce33f791cde77156d1f84519713ac47c37c5

SHA512
ec857db1522f15d6b769dc775550eb0023e27c080de45f6c091bae25b8524ed17fba0ca84af38459bb1d772bf479327b031e5ef677d3eb7f65c703c03fc70b84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
e4088787285c539dabdb303f1df8d2cc

SHA1
2f5c0fe3d7f2791ac619c0cca5e86146b83ab1bc

SHA256
5ab42f7a420763005c6769e0aa075d1825d64179bbf1036c9c12f0d662cb5e09

SHA512
58ef008d5868ac3ea239930ff2344d815f76668b497eaf7231883d12fa385ddcfa16393fa096d2d6ffb46881d8f86d23ae0b7c18f8235e0fd47b395ecb051e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
364B

MD5
59ce0172d0730c38358ae5b291738b85

SHA1
dcb11424815edfd3bbe6929c053f8af00bf90c2d

SHA256
a97a50922947bf7d20e924f6b459fb481e9c2f5860c8c09c79b11e0f6e652c72

SHA512
cb551d04c7f0eae0ad9ae758e0135c48f6140eafa90f03d32d5850818a07bd4e43be97c6ec3529f41c8d311abaa964732f4054e63cbd75efda167b09b84ed1aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
523B

MD5
c85db21ec14cb25e7f38c2202117dcf1

SHA1
c3a172605d4aaf6fab8137791c2e48ff1033eae2

SHA256
0628a4e0abb5f041cdca6df31b8a7bdd964987bd11035bde80479f1b24ae7bf4

SHA512
c30093cb2d44f940a6d3b3d96dbdf2992d9c0358056cfd27260fa4588a54a3a25c8e092aadc1f3434e28cfdbd76a6a97dcde45d1e239191afeae2f535be4977b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
92d968ec8ca70eb972fceb710998b4c9

SHA1
a374658adb49a95f29a4addc588b8822920932d6

SHA256
5e475dd1e08485f3366fda05dbe79c3e789a6e480d3755c10961995bd97bb0d9

SHA512
15aa420c20df50ceb505f472ccadebd01de2fe68a2a0bec634ef74c6d8bf289120cac5dbb0e5300b5cf4ad3cb52e1b7bbeadbd2dc786d6ac322456a9a634564a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc820cd211ab4f0cf3335d25d4160000

SHA1
312492cd9b3f4a72d8b58f773c9c81a5d96b0ce6

SHA256
917772b0bbc9b4b39ab8c487a3f31ff7282a8c2684d3d2b6a1b04aab6e8f1746

SHA512
5857fb771b49596265fc31f635b4d8cc3cefcad890b93177f64ce23ca036a81e3feb19d6f7bd483d596dfa95c829c7787162856d448f4e2541893154caf4de79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b6ee35d8ca81dc9727427f0a056ad32

SHA1
87bc4dbf48b133f5682ecc51845c03ab61495098

SHA256
5bf332ea17ab4522f620ec79e5edf480e51f756e847d7cac27fbcedfb94dc3a3

SHA512
022aa1351cfe058f641905fdb12f017aa7f8f317f29042f8fd947685a59dd6a181dbb8164de8a7fdd6bfb5c92c85c5d93a3231da14ee84c6d3a531ca6fe14c4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c8ae1a9a3e78d78a5841534cb64869c2

SHA1
fb85101ca7265441d07e3dc6de9a918193ea33db

SHA256
4fb7658a3e984e4ffada90d965f0afb68d78bed60ab2a7faeb5a3b9745f39292

SHA512
da6a9934f8955503e104bed01e1f7aef81293c5353a93ffdd5b1e48a08f798e2aa4ba0bfb09970a7e42eaeee495f64d4e3c78188dfe0003bc986395de83f9e08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e5d0fc298ecfa0b3de888c21dfc2d4a7

SHA1
d13efff9a66a970de90f94e3a63afa81d06431be

SHA256
d8b5ce890747575510af2f1f7ae4ba11f64a66f9337b548555d1a842e1e2aa3f

SHA512
55244430f14e9e5460b9b49086b7d62384cd64f0be69fd68b8619450dfebbf982f196638da952a9a9268e0d40fbf13a46e2e06455daab668a391186db2b911c2

Download Submit